Define "brand" and "full version" for CH-UA about client-hints-infrastructure

[miketaylr]

Hi @romainmenke, thanks for the issue!

One major challenge here are the non Safari browsers and webviews on iOS and Chromium based browsers like Edge, Samsung Internet, Opera, ...

To confirm, you mean all browsers on iOS, correct? Or do you also mean webview on Android?

I agree that it would be nice if Chrome for iOS supported UA-CH (as well as Safari).

My concern is that brand and full version are too vague in the current specification.

Would you mind clarifying what you mean here?

[romainmenke]

To confirm, you mean all browsers on iOS, correct? Or do you also mean webview on Android?

I do not have an android device so I can not easily judge the situation on Android.

---

@romainmenke said :

My concern is that brand and full version are too vague in the current specification.

@miketaylr said :

Would you mind clarifying what you mean here?

The current behaviour for Chrome on iOS is to erase the information about the underlying engine in the user agent string. They replace it with CriOS/x.y.z.

The same is done by every other browser I could test in iOS except Brave. Brave chooses to preserve the actual information.

My concern is that brand and full version are too vague.
Do you list the brand and version of the label on the outside : CriOS x.y.z?
Or do you list the brand and version of the actual browser : Safari x.y.x?

The same issue exists for every Chromium based browser.
Is it Opera x.y.z or Chromium x.y.z.

This part of the specification is line with my concern :

While I'm optimistic that we can reset
expectations around sniffing by freezing the thing that's sniffed-
upon today, and creating a sane set of options for developers, it's
likely that this is hopelessly naive. It's reasonable to ponder what
we should do to encourage sniffing in the right way, if we believe
it's going to happen one way or another.

There are valid use cases for user agent sniffing for applications like polyfill.io.
These only intend to make as many websites work for as many people as possible.

But the current wording of the specification allows anything as brand and full version.
Also values which are non-bogus but still technically incorrect.

Requiring at least the inclusion of the underlying engine name and its version would be more useful in my opinion. But maybe this is not the intended use case for Sec-CH-UA?

[romainmenke]

To state it differently.

The current specification takes into account the anti-pattern of websites checking for older user agents and blocking end users from accessing content. It tries to prevent this with GREASE-like UA strings.

It however doesn't state anything that user agents must add correct information about their engine identity. (maybe I missed this completely)

To work through this issue both sides need to be done correctly.
User agents need to advertise correctly who they are and sites need to correctly parse and handle this information.