-
Notifications
You must be signed in to change notification settings - Fork 29.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
lib: add navigator.userAgent
#50200
lib: add navigator.userAgent
#50200
Conversation
1704a23
to
218c1a1
Compare
The
notable-change
Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. |
Two questions:
|
Some packages might depend on navigator.userAgent to detect if it's not Node.js or not. I don't want to introduce breaking change.
navigator.userAgent is included in WINTERCG Minimum Common Web Platform API - https://common-min-api.proposal.wintercg.org |
The default value contained in this PR is currently different from the value used in native There is also some discussion about not including the version number that may be of relevance here. I think if Node.js exposes a user agent in multiple places, it needs to be the same everywhere. |
the version should be removed, so either "node.js" or "node". Undici uses "node" so that would make our lives easier (the fetch user-agent and navigator user-agent seem like they should be equal, although I'm not entirely sure). |
Referencing WINTERCG, it's recommended to have a product version with the user agent. I'm more in favor of having the version:
|
218c1a1
to
b92833e
Compare
There are legitimate security concerns by adding the node version, maybe something like what Chrome is doing would be acceptable? If you don't want to click that they're replacing minor version numbers with zeros (ie. |
b92833e
to
6b9fd6e
Compare
I thought about the version. I am +1 for adding the version. First of all, the userAgent is in browsers used for requests. We dont expose the version via a http request nor via a http response. Browsers expose this information with their version via request and they dont consider it as a security issue. If it would be a security issue chrome, safari and co would have removed the version information long time ago. Also comparing to deno and bun, they also expose the version. So I am 100% hoping that the version gets exposed. |
Actually Chrome only exposes the major version; they consider exposing the minor/patch versions to be a security concern. See the But we can do the same, it’s better than not including a version. |
Chrome did limit it, from the link I posted above:
Firefox also limits some information (windows & macOS versions are capped at 10 and 10.15 respectively, and some architectures don't include any information in their user-agent header). (Source) I'd assume they have plans to limit it further. |
Yep, this was my proposed alternative. |
I'll update the PR with the proposed change. |
This isn’t semver-major, the semver-major change was adding |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
RSLGTM
💯 agree! Also something to consider: it looks like there is existing code out there that looks for For example: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm
Landed in 05a7810 |
I really think the user-agent keys should match #50200 (comment) Can we update it ? |
honestly i'm starting to question the benefit of having |
PR-URL: #50200 Reviewed-By: Geoffrey Booth <[email protected]> Reviewed-By: Matthew Aitken <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Vinícius Lourenço Claro Cardoso <[email protected]>
Notable changes: doc: * add H4ad to collaborators (Vinícius Lourenço) #50217 esm: * (SEMVER-MINOR) detect ESM syntax in ambiguous JavaScript (Geoffrey Booth) #50096 fs: * (SEMVER-MINOR) add flush option to appendFile() functions (Colin Ihrig) #50095 lib: * (SEMVER-MINOR) add `navigator.userAgent` (Yagiz Nizipli) #50200 stream: * (SEMVER-MINOR) allow pass stream class to `stream.compose` (Alex Yang) #50187 * call helper function from push and unshift (Raz Luvaton) #50173 PR-URL: #50335
Notable changes: doc: * add H4ad to collaborators (Vinícius Lourenço) #50217 esm: * (SEMVER-MINOR) detect ESM syntax in ambiguous JavaScript (Geoffrey Booth) #50096 fs: * (SEMVER-MINOR) add flush option to appendFile() functions (Colin Ihrig) #50095 lib: * (SEMVER-MINOR) add `navigator.userAgent` (Yagiz Nizipli) #50200 stream: * (SEMVER-MINOR) allow pass stream class to `stream.compose` (Alex Yang) #50187 * call helper function from push and unshift (Raz Luvaton) #50173 PR-URL: #50335
Notable changes: doc: * add H4ad to collaborators (Vinícius Lourenço) #50217 esm: * (SEMVER-MINOR) detect ESM syntax in ambiguous JavaScript (Geoffrey Booth) #50096 fs: * (SEMVER-MINOR) add flush option to appendFile() functions (Colin Ihrig) #50095 lib: * (SEMVER-MINOR) add `navigator.userAgent` (Yagiz Nizipli) #50200 stream: * (SEMVER-MINOR) allow pass stream class to `stream.compose` (Alex Yang) #50187 * call helper function from push and unshift (Raz Luvaton) #50173 PR-URL: #50335
Notable changes: doc: * add H4ad to collaborators (Vinícius Lourenço) #50217 esm: * (SEMVER-MINOR) detect ESM syntax in ambiguous JavaScript (Geoffrey Booth) #50096 fs: * (SEMVER-MINOR) add flush option to appendFile() functions (Colin Ihrig) #50095 lib: * (SEMVER-MINOR) add `navigator.userAgent` (Yagiz Nizipli) #50200 stream: * (SEMVER-MINOR) allow pass stream class to `stream.compose` (Alex Yang) #50187 * call helper function from push and unshift (Raz Luvaton) #50173 PR-URL: #50335
Notable changes: doc: * add H4ad to collaborators (Vinícius Lourenço) #50217 esm: * (SEMVER-MINOR) detect ESM syntax in ambiguous JavaScript (Geoffrey Booth) #50096 fs: * (SEMVER-MINOR) add flush option to appendFile() functions (Colin Ihrig) #50095 lib: * (SEMVER-MINOR) add `navigator.userAgent` (Yagiz Nizipli) #50200 stream: * (SEMVER-MINOR) allow pass stream class to `stream.compose` (Alex Yang) #50187 * call helper function from push and unshift (Raz Luvaton) #50173 PR-URL: #50335
PR-URL: nodejs#50200 Reviewed-By: Geoffrey Booth <[email protected]> Reviewed-By: Matthew Aitken <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Vinícius Lourenço Claro Cardoso <[email protected]>
Notable changes: doc: * add H4ad to collaborators (Vinícius Lourenço) nodejs#50217 esm: * (SEMVER-MINOR) detect ESM syntax in ambiguous JavaScript (Geoffrey Booth) nodejs#50096 fs: * (SEMVER-MINOR) add flush option to appendFile() functions (Colin Ihrig) nodejs#50095 lib: * (SEMVER-MINOR) add `navigator.userAgent` (Yagiz Nizipli) nodejs#50200 stream: * (SEMVER-MINOR) allow pass stream class to `stream.compose` (Alex Yang) nodejs#50187 * call helper function from push and unshift (Raz Luvaton) nodejs#50173 PR-URL: nodejs#50335
Follow-up for #47769
cc @nodejs/tsc