Well, I've been working on an User-Agent based shared-session protection between subdomains.
I was extremely surprised that it's been working well until IE 11 preview was released recently. There are 2 subdomains
example.com and sub.example.com
I've intercepted requests to both domains and it seems that USER-AGENT HTTP Header being sent to each domain is different.
Request to example.com has:
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Request to sub.example.com has:
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; BRI/1; MS-RTC LM 8; rv:11.0) like Gecko
Do you have any idea what is the reason for this strange dynamic behavior?
Microsoft has the site in question configured to use UA-spoofing (via the Compatibility View list) and that causes IE to send a custom UA string.
CompatView-based UA spoofing was enabled in IE8 in 2008: http://blogs.msdn.com/b/ie/archive/2008/08/27/introducing-compatibility-view.aspx
And in IE10+, it's gotten richer, with per-site spoofing to enable the best experience. See http://blogs.msdn.com/b/ieinternals/archive/2013/09/21/internet-explorer-11-user-agent-string-ua-string-sniffing-compatibility-with-gecko-webkit.aspx for an exploration of this topic.
Official Microsoft Documentation on MSDN:
Quotes:
For many legacy websites, some of the most visible updates for IE11 involve the user-agent string. Here's what's reported for IE11 on Windows 8.1:
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
Here's the string for IE11 on Windows 7:
Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
In rare cases, it may be necessary to uniquely identify IE11. Use the Trident token to do so.
Isn't it nice, they say "like Gecko"? ;)
来源：https://stackoverflow.com/questions/18005832/ie-11-sends-different-user-agent-header-to-different-subdomains