Opened 6 months ago

Last modified 6 months ago

#2644 new defect

Different User-Agent detection at nginx and PHP via FastCGI

Reported by: kostroma.tvil.ru@… Owned by:
Priority: minor Milestone:
Component: nginx-core Version: 1.25.x
Keywords: UserAgent Cc: kostroma.tvil.ru@…
uname -a: Linux front 5.10.0-21-amd64 #1 SMP Debian 5.10.162-1 (2023-01-21) x86_64 GNU/Linux
nginx -V: nginx version: nginx/1.18.0
built with OpenSSL 1.1.1n 15 Mar 2022
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -ffile-prefix-map=/build/nginx-x3gsRV/nginx-1.18.0=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-compat --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_sub_module

Description

Hello.
In part of incoming requests, nginx defines the "User-Agent" header like "okhttp/4.9.2", but PHP via FastCGI defines it like "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36".

No specific UA config settings at all.
How it possible?
Thank you.

---
PHP 8.2.15 (cli) (built: Jan 20 2024 14:14:18) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.15, Copyright (c) Zend Technologies

with Zend OPcache v8.2.15, Copyright (c), by Zend Technologies

[HTTP_USER_AGENT] => Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Change History (2)

comment:1 by Roman Arutyunyan, 6 months ago

"okhttp/4.9.2" means the connection came from okhttp.
"Mozilla..." means the connection came from a browser.

Can you please clarify your question.

in reply to:  1 comment:2 by kostroma.tvil.ru@…, 6 months ago

Replying to Roman Arutyunyan:

"okhttp/4.9.2" means the connection came from okhttp.
"Mozilla..." means the connection came from a browser.

Can you please clarify your question.

Роман, один и тот же запрос в логах nginx отображается как UA "okhttp/4.9.2", при этом PHP8.2 через FastCGI видит UA как "Mozilla...". Загадка, как это возможно, что бы и там и там на одном и том же запросе был UA.

Version 0, edited 6 months ago by kostroma.tvil.ru@… (next)
Note: See TracTickets for help on using tickets.