Matching a User-Agent in Squid
Use a req_header ACL for a declared client identifier and place the access rule before a broader allow.
A User-Agent ACL matches the identifier a client puts in its HTTP request. In a Squid 7 configuration, a test client can be classified with req_header:
acl legacy_probe req_header User-Agent -i ^LegacyProbe/
http_access deny legacy_probeThe example matches a header beginning with LegacyProbe/, without case sensitivity. Replace the pattern with the intended client identifier. The expression is a regular expression, not a browser product name lookup.
Put the deny rule before any broader access rule that would already allow the request. Retain the proxy's existing client and destination controls around this targeted rule.
A broad prefix such as Mozilla matches many different browsers. Use the actual header sent by the client when deciding how narrow a compatibility or test policy should be.
The client controls this header and can change or omit it. The rule classifies a claimed identifier; it is not a strong application identity. It also operates on HTTP messages Squid can inspect, not on encrypted website headers inside an ordinary CONNECT tunnel.