CBC related TLS cipher suites to be disabled in the server side I understand the TLS cipher suites using CBC mode are susceptible to timing attacks. From that understanding it seems that the cipher suites using GCM (CTR-based) are safe to use considering they don't need padding.

However, in Java, SunJSSE provider by default enables many cipher suites that are using CBC. And whether those cipher suites will be used or not are determined by the client preference. 

While using Chrome and FireFox latest versions, I noticed the cipher suite used is AES_128_GCM. 

Now, is it advisable to disable all the CBC related cipher suites in the server to ensure only GCM is used regardless of the client preferences? Is there any limitation with this approach of using only GCM related cipher suites?
Based on the useful comments above, some of the resources I found to provide an insight into the matter is as follows:


TLS Support tells us which browser versions support which TLS versions. Since (as puzzlepalace mentioned) GCM was introduced in TLSv1.2, we get an idea as to what browser versions we'll miss out by supporting only GCM
Qualys (as forest mentioned) shows some of the best SSL configured website and the cipher suites used. This also shows the cipher suites used by your browser. The best practices for TLS deployment and the recommended list of cipher suites are listed here. Finally, this table lists which browser versions support what.


In summary, all major browsers support TLS 1.2 since Oct, 2013 and therefore GCM.

Forward secrecy (ECDHE) is available from even before.