Change original user-agent Header

[verbal666]

Hi genotrance.

I set PX to use

--useragent= | PX_USERAGENT= | proxy:useragent=
  Override or send User-Agent header on client's behalf

To make it impersonate a Mozilla client.

But in my WebServer i see the original UA is logged (curl 8.9.1),

1.2.3.4 my.domain my.domain [TLSv1.3] - - [24/Feb/2025:04:01:06 +0100] "GET / HTTP/1.1" [302] - 0 27 27423 "-" "curl/8.9.1"

Parent Proxy, right,

TCP_TUNNEL/200 [200] 3742 CONNECT my.domain:443 - HIER_DIRECT/1.2.3.4 - "Mozilla/5.0 My_Personal_UA" [User-Agent: Mozilla/5.0 My_Personal_UA\r\nProxy-Connection: Keep-Alive\r\nHost: my.domain:443\r\n] [-] [HTTP/1.1 200 Connection established\r\n\r\n]

PX

MainProcess: Thread_0: 1740478611: /set_headers/set_useragent/dprint: 1746511102768: Setting user agent to curl/8.9.1
MainProcess: Thread_0: 1740478611: /do_curl/set_useragent/dprint: 1746511102768: Setting user agent to Mozilla/5.0 My_Personal_UA
MainProcess: Thread_0: 1740478611: /_socket_action/debug_callback/dprint: 1746511102768: Sent header => User-Agent: Mozilla/5.0 My_Personal_UA
MainProcess: Thread_0: 1740478611: /debug_callback/save_auth/dprint: 1746511102768: Checking proxy auth mechanism: User-Agent: Mozilla/5.0 My_Personal_UA

--useragent is only for parent Proxy call?

Is that right or i missed something?

PS. don't want to use "-A" with curl, if PX can rewrite header "User-Agent: Mozilla/5.0 My_Personal_UA". But can PX rewrite client UA?

Thanks.

[genotrance]

You are using HTTPS so once the connection is established with the upstream server via Px, everything is directly happening between the client and the server with Px simply copying encrypted packets back and forth. So the server sees the actual user agent headers from your client at that point rather than what Px sent during the connect phase.

[verbal666]

Sure, clear 👍👍👍

Client <=> PX <=> FORWARD TO PROXY CONNECT <=> TLS handshake => encrypted HTTPS with headers 👍

So the only way it to manage client side the header User-Agent 👍

Can't find a way to rewrite ALL https headers with a proxy. Need an HTTPS PROXY in the middle, for sure. Tried with a simple Privoxy, but can't find an easy way. I'll try better also with a Squid SslBump config with its certs👍

Client <=> Privoxy TLS handshake [change UA header] <=> PX <=> FORWARD TO PROXY CONNECT <=> TLS handshake => encrypted HTTPS with new UA header

Many thanks!!! 👍

[verbal666]

Just for information, solved via Squid HTTPS.

clients <=> SQUID [HTTPS] <=> PX <=> MAIN PROXY <=> remote server

1.2.3.4 my.domain.com my.domain.com [TLSv1.3] - - [26/Feb/2025:10:58:41 +0100] "GET / HTTP/1.1" [301] 357 0 19 19361 "-" "My_Personal_UA_for_All_CONNECTS"

For Squid users,

http_port 3128 ssl-bump cert=/etc/squid/ssl/myCA.pem key=/etc/squid/ssl/myCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
tls_outgoing_options cipher=ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384
sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 20MB
request_header_access User-Agent deny all
request_header_replace User-Agent My_Personal_UA_for_All_CONNECTS
sslcrtd_children 5
ssl_bump server-first all
ssl_bump bump all