search

ray-lothian / UserAgent-Switcher

A User-Agent spoofer browser extension that is highly configurable
https://webextension.org/listing/useragent-switcher.html
Mozilla Public License 2.0
935 stars 144 forks source link

Doesn't spoof the value of navigator.userAgent #22

Closed madduck closed 5 years ago

madduck commented 6 years ago

Without also ensuring that the value of navigator.userAgent is set to the spoofed string, it will be trivial for any site capable of serving JavaScript (and having it executed) to infer and ignore the spoofed request header.

With the WWW becoming ever less useful without at least allowing 1st-party JS, this may compromise the effectiveness of this add-on when confronted with antagonists willing to post back data from client-side. It'd be nice to plug this last leak.

(shamelessly copied from https://github.com/LeoTindall/randomua/issues/6)

ray-lothian commented 5 years ago

We do spoof the value of navigator.userAgent!