"https://wwws5.hsbc.com.br" complains about the a old safari version

[Renato Araujo Oliveira Filho]

I am trying to access my account on brazilian hsbc bank.

And I am getting a error saying that I am using a old safari 2.0 web browser.

How to reproduce:

1- On webbroser go to "https://wwws5.hsbc.com.br" will appear 2 fields on the center of the screen
2 - Fill these fields with any value
3 - Click on the red button next to the second filed

What is expected:
Open the bank password page (with a virtual keyboard)

What is happening:
A page saying that my browser is not supported.

[Renato Araujo Oliveira Filho (renatofilho)]

The full address of this site is: https://wwws5.hsbc.com.br/ITE/connect2/wcm_connect/pws/hsbc-online-cnb.html

[Olivier Tilloy (osomon)]

I’ve tried setting a UA override for the entire hsbc.com.br domain, but this didn’t seem to make any difference, their "security module" still identifies the browser as "Safari 2.0 for Android".

For reference, here is the UA override rule I tried (here with the iOS 5 string, also tried with that of chrome on android on galaxy nexus):

    [/^https?:\/\/www(s\d)?\.hsbc\.com\.br\//, "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46
 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3"]

[Olivier Tilloy (osomon)]

If, instead of an override rule, I overwrite the default UA string to set it to e.g. that of an iphone, then the site loads correctly. So there must be some HTTP request to another domain that is used to determine the UA.

[Olivier Tilloy (osomon)]

I found the issue.

It seems that hsbc is first loading a script that queries the value of navigator.userAgent and then issues the subsequent queries based on this. The browser has a mechanism to override the value of navigator.userAgent, but it never worked because of a typo… D’oh!