If AppleWebKit appears in the user agent does that mean it's definitely an apple device?

Question

User agents can detect the AppleWebKit. This is a browser engine used primarily on Apple devices, BUT also on BlackBerry Browsers, PlayStation consoles and the Tizen mobile operating system. Also, you can find AppleWebKit appearing in the Android device list for user agents.

Thus, it seems as though the AppleWebKit does not actually uniquely identify the user's device as belonging to apple.

Which part of the user agent string does?

Yiyid

Answer 1

The main problem is that most useragent string indicate what they are compatible with instead of what they are made of. So lots of browsers that do not have AppleWebKit still report it as part of the useragent string.

I wrote a blog about this a few years ago which may interest you: https://techlab.bol.com/making-sense-user-agent-string/

If you want a list of the "rules" that determine if it is an Apple device then I can assure you that no 100% accurate list exists.

I like to think my set of rules come close; but never 100%.

Hachure

Answer 2

Considering that many browsers allow the user to change the user-agent string to whatever they wish, I would say that no part of it identifies the device vendor.

Looking at whatismybrowser.com, it seems that your best bet is to look for the string "Mac OS X" (yes, even after name changes to "OS X" and "macOS") as that seems to be included in the user-agent string for iPad OS and iPhone OS as well, but a browser on any non-Apple device could also include it (again, the user can often change the user-agent string as they wish), so you can't be 100% certain that they are on an Apple device just because the string is there.

Then again, someone changing their user agent to something that looks like an Apple device probably wants you to think they're on such a device, so you might as well humor them unless you actually need to know their device in order to do something only capable on that device - in which case you probably shouldn't do user-agent matching anyway but instead use other methods to figure out what the current device is capable of.

Examples:

• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15
• Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148
• Mozilla/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148

Examples taken from:

• https://developers.whatismybrowser.com/useragents/explore/operating_system_name/macos/
• https://developers.whatismybrowser.com/useragents/explore/operating_platform/iphone/
• https://developers.whatismybrowser.com/useragents/explore/operating_platform/ipad/

Irish

Answer 3

Nothing is 100% in web communication.

1. it's up to the client program to define the user agent. (how and whether they choose to specify something is totally up to the developers of said program)
2. Anyone with some knowledge of a capable programming language and a working internet connection can make a request, and fill it with completely arbitrary data. (a header might not even be present, or might have garbage values) How server programs cope with that is up to them.

I was monitoring traffic the other day when I gave a custom response to someone doing port scans. I sent an HTTP response saying "quit it with the ip stuff" (since they specified my IP in the "host" header, rather than the website), they sent another request a bit later after, removing the host header entirely and changing their user agent to a description of their organization. (just your friendly neighbourhood network analysis people)

Expostulatory