Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Web browsers with an end of life no longer receive security updates which not only makes them vulnerable to the end user, but I imagine its not safe for the server's which receive visits by them either.

Is it practical to block or enforce and notify the end user that their browser is unsafe and unsupported? If so, how would one achieve that? I don't know of any official or crowd-sourced listing with that information to parse and keep up to date. I'm aware that the practice can be custom built with User Agent parsing and feature detection for HTML5 enabled browsers.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

A user with an insecure browser cannot harm a server. It's the other way around.

And now....

No! No! No! No! No! Never block a browser!

If you build a site using Progressive Enhancement you can support every browser regardless of functional capabilities. A well-built website will be usable and accessible without CSS, JavaScript, and images. It may not look pretty and may not be as pleasant of an experience, but the content is still reachable. Then users who do support newer browser functionality will get an enhanced experience. It's quicker and easier to do then most web developers think.

If for some reason you need to identify a browser never use user agents to identify them. They are easily spoofed and unreliable. Use feature detection instead.

A nice side effect of this is your website will be be search engine optimized as well since they are essentially as capable as Netscape and MSIE 2.0.

share|improve this answer
    
Feature detection works for HTML5 capable browsers, but what about pre-HTML5 browsers? I'm not yet in the practice of using feature detection so have not experienced it in action. –  Sn3akyP3t3 Jun 22 '12 at 20:37
    
Feature detection is independent of HTML versions or even browser versions. You just check for a feature and if it is unavailable you know it won't work in that browser and vice-versa. –  John Conde Jun 22 '12 at 20:47

Please refer to this for a near-comprehensive list of browsers and their user-agents.

You can edit your Apache config or make a .htaccess file with this in it to block those specific user-agents, or the browsers you don't want to visit:

#redirect those user agents to another page.
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^useragent-string1 [OR]
RewriteCond %{HTTP_USER_AGENT} ^useragent-string2 [OR]
RewriteCond %{HTTP_USER_AGENT} ^useragent-string3
RewriteRule ^(.*)$ http://path.to.your/error/page.html

To quote you: "I'm aware that the practice can be custom built with User Agent parsing and feature detection for HTML5 enabled browsers." Why would you want to block browsers that support HTML5, since those are generally the more modern and secure browsers?

share|improve this answer
    
I mentioned feature detection as well as UA sniffing because they are the only methods I'm aware of for identification of the browser. I don't intend to block HTML5 capable browsers. Sorry for the confusion. –  Sn3akyP3t3 Jun 22 '12 at 20:30
    
@Sn3 - Not a problem. –  ionFish Jun 22 '12 at 20:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.