Description:

When URLs are sent in Rocket.Chat the oembed request uses a spoofed User-Agent. This value is configurable in the Admin settings, but the default should be tweaked to specify it's coming from Rocket.Chat.

Server Setup Information:

• Version of Rocket.Chat Server: 3.6.3
• Operating System: Linux
• Deployment Method: docker
• Number of Running Instances: 1
• DB Replicaset Oplog: yes
• NodeJS Version: the one in docker
• MongoDB Version: 4.x

Steps to reproduce:

1. Send a message with a URL in it.
2. Rocket.Chat makes a request to that URL with the default setting of User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36.

Expected behavior:

The default setting should allow this request to be made with a User-Agent that specifies that it is Rocket.Chat making the request.

Actual behavior:

Due to the spoofed User-Agent the destination web server is unable to know that this is Rocket.Chat making the request, and cannot determine it should be treated as a bot.

Server Setup Information

This is a hosted install.