Open LiviaMedeiros opened 2 years ago
In my experience parsing user-agents is a primary source of ReDoS for servers. It's not something we should encourage on the default setting.
I think we should support configuring it on the Agent
and applying it to all requests (this might be a good thing to have for other headers too).
In node-fetch
we decided on exposing the most minimal information possible to avoid leaking any information that might be harmful... we ultimate decided that we would use a complete static string https://github.com/node-fetch/node-fetch/issues/527
This would solve...
User-Agent
with additional information might help server to be aware of possible features, limitations and quirks of client.The implementation should look like...
Default
user-agent
having value of`undici/${version}`
or`undici/${version} Node.js/${nodeVersion}`
.I have also considered...
`undici/${version} (${osInfo}) Node.js/${nodeVersion}`
but it's probably too much.Additional context
Quirks that deserve decisions on server side might be discovered much later than corresponding version had released.