移动APP后端PHP收到桌面UA，是否来自合法移动设备？

Absolutely, that desktop-style User-Agent (Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36) can absolutely originate from legitimate mobile devices. Here are the most common, valid scenarios:

• Mobile browsers in desktop mode: Virtually every mainstream mobile browser (Chrome, Safari, Edge, Firefox) includes an option to "request desktop site." When enabled, the browser intentionally swaps its default mobile User-Agent for a desktop equivalent. This is a standard, user-initiated feature for accessing sites that aren't optimized for mobile layouts.

• WebView-based apps with custom UA settings: If your mobile app uses a WebView component (or interacts with another app that does), developers often override the default User-Agent to a desktop string. This is usually done to ensure compatibility with APIs or web content that’s only designed to respond to desktop clients—and it’s a legitimate, intentional configuration.

• Mobile automation/testing tools: Legitimate QA workflows (like teams using mobile emulators or automation frameworks) might send desktop User-Agents while running tests on actual mobile hardware. This is a common practice to validate cross-environment behavior of apps or APIs.

A Quick Validation Tip #

User-Agent strings are extremely easy to spoof, so they shouldn’t be your only source of trust for identifying legitimate mobile traffic. To get a clearer picture, consider combining UA checks with other signals:

• Unique app-specific authentication tokens or headers
• IP address geolocation and mobile carrier ranges
• Device-specific HTTP headers (like X-Requested-With for Android WebViews)

内容的提问来源于stack exchange，提问作者JohnMoll