Intent to Prototype: User-Agent Client Hints GREASE Update
Matt Reichhoff
Contact emails
mreic...@chromium.org, b...@chromium.org, mike...@chromium.org, jadek...@chromium.org
Explainer
https://github.com/WICG/ua-client-hints#user-agent-client-hints
Specification
https://wicg.github.io/ua-client-hints/#create-arbitrary-brands-section
https://wicg.github.io/ua-client-hints/#grease
API spec
Yes
Summary
This proposal seeks to align our implementation of GREASE in User Agent Client Hints with the current spec, which includes additional GREASE characters beyond the current semicolon and space, and which recommends varying the arbitrary version.
Blink component
Motivation
User-Agent GREASE is intended to discourage arbitrary user agent blocklists and other assumptions being built on top of the User-Agent header. A similar concept exists in TLS. This practice is currently implemented in Chromium, but todayâs implementation differs slightly from the current spec. If implemented, this proposal would enable additional GREASE characters (the full list includes the following ASCII characters: 0x20 (SP), 0x28 (left parenthesis), 0x29 (right parenthesis), 0x2D (-), 0x2E (.), 0x2F (/), 0x3A (:), 0x3B (;), 0x3D (=), 0x3F (?), 0x5F (_)) and vary the arbitrary version over time. Note that the GREASE portion of the header would remain constant per major version, in accordance with the spec.
TAG review
UA-CH is currently in review.Â
Risks
The prior inclusion of escaped ASCII 0x22 (double quote) and 0x5C (backslash) proved to be web incompatible and was rolled back. While we do not anticipate similar problems with the updated character list, we will take the following actions to validate this assumption:
Pre-launch testing of the new characters against known-common sites, which will include tests against the components known to have been incompatible with the prior implementation.
A phased rollout along with monitoring of HTTP 4XX response rates.
Pre-launch testing of the new characters against known-common sites, which will include tests against the components known to have been incompatible with the prior implementation.
A phased rollout along with monitoring of HTTP 4XX response rates.