What is the User-Agent header?

Short answer

User-Agent is the request header that identifies the browser or client application sending the request (name, version, operating system, device); for example, Mozilla/5.0 (Windows NT 10.0; …) Chrome/…. Because its value is set by the client, it can easily be changed, and some clients do not send it at all. In TR7, User-Agent is the input of four conditions: the Browser, Operating System, Mobile Platform and Bot Type conditions compare the header with known signatures and decide based on the browser, operating system, mobile platform or bot type. The value of the header is written to another field with the Request HTTP header content smart variable; the Browser, Operating System and Device Type filters on the HTTP Logs screen are also parsed from this header.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Conditions (Policy Match) → Criteria	Browser, Operating System, Mobile Platform, Bot Type	An action and Conditional Backend Services decision based on the browser, operating system, mobile platform or bot type
Load Balancer → Conditions (Policy Match) → Criteria	HTTP Header (Header name: user-agent)	Matching on the raw value of User-Agent
Action value fields → Smart Variables	Request HTTP header content (Header name: user-agent; short name ↓UA)	Writing the value to a header or a log line
vService → Logs & Tracking → HTTP Logs → Filter	Browser, Operating System, Device Type, Browser Version	Filtering records by client type
Left Monitor Panel → WAF-Protected vServices → vService → Event Logs → Filter	User Agent, Browser, Operating System, Device Type, Browser Version	Filtering WAF records by client

Common Misconceptions

• "User-Agent is a reliable identity." Bots can send values that look like a browser; the Bot type condition separates only the bots that identify themselves in User-Agent (How do I detect bots; can I allow good bots (Googlebot etc.) and block bad ones?).
• "A request without User-Agent is invalid." Many API clients and scripts do not send the header; in this situation, the Browser, Operating system and Mobile platform conditions do not match.
• "To separate mobile devices, a regex has to be written for User-Agent." The Mobile platform condition works with ready-made signatures (Can I send mobile devices to a separate backend?).

How it is done in the documentation

• Browser
• Operating System
• Mobile Platform
• Bot Type
• HTTP Logs · Filter

Related questions

• Can I send mobile devices to a separate backend?
• How do I detect bots; can I allow good bots (Googlebot etc.) and block bad ones?
• What is an HTTP Header?