Is there any plausible circumstance in which the navigator userAgent reported by Javascript could be different from the one sent as User-Agent Header.
Part of the reason I am asking is that: I have an app that collects the User Agent from JS to report back to the server. It's not necessary in most legit cases. However, could they actually differ or lie?
navigator.userAgent being 'read only' makes the change unlikely. I am just wondering if a hacker or an extension could in fact do so, on common browsers or a headless browser, for whatever reason.
Ok, so here is an answer from my own tests and research. There are three types of user agent differences between header and client side in the wild:
The short UA strings policy by IE sending a pre and post platform registry value tokens to the server to improves compatibility and network performance. With the extended UA string provided through navigator.userAgent. They then added the ability to add extension tokens.
The Tor Browser for iOS sends a Windows Desktop Firefox user agent by default.
Currently: Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0
Javascript however reports a generic Safari Mobile web view user agent.
UCMini (U2) send a UCWeb User Agent with the request such as:
UCWEB/2.0 (iPad; U; CPU OS 7_1 like Mac OS X; en; iPad3,6) U2/1.0.0 UCBrowser/9.3.1.344
While the client side reports this wackadoodle:
Mozilla/5.0 (X11; U; Linux i686; zh-CN; r:1.2.3.4) Gecko/