Client hints for WebView-based apps

[dgstpierre]

In the current user agent we have an indicator of 'wv' that assists with identifying web apps. As well as the web app adding it's identity. I don't see anything that accounts for this, looks like lost functionality.

[miketaylr]

In the current user agent we have an indicator of 'wv' that assists with identifying web apps.

Can you clarify what you mean by web apps? Do you mean native apps with a webview component?

[dgstpierre]

Yes that is what I mean. The user agent currently has 'wv' in it to indicate.

[miketaylr]

Thanks, changing the title accordingly. This seems useful to consider.

[ronancremin]

Note that the Chromium blog stated that "have no plans to change the User-Agent string on Android WebView or Chrome for iOS at this time, but will make public updates if and when that changes."

So, by default, apps using the default Chrome-based Android webview ("Android System WebView") will presumably continue to behave as before—perhaps @miketaylr can confirm.

[miketaylr]

Correct, this is not an announcement that anything is changing from what is previously announced. To be clear, I'm saying it may be useful to consider a specific type of client hint to a webview.

[ronancremin]

Understood, thanks.

[dgstpierre]

I wanted to check in on this with the user agent reduction coming for mobile devices in a few months. Will the user agent reduction remove wv? Or will it still be there to fall back on if user agent hints doesn't add a way to support it? Thanks

[Sora2455]

Why couldn't the browser just be listed as "Chrome WV" instead of "Chrome"?

[miketaylr]

I wanted to check in on this with the user agent reduction coming for mobile devices in a few months. Will the user agent reduction remove wv? Or will it still be there to fall back on if user agent hints doesn't add a way to support it? Thanks

The upcoming changes won't affect webview. Right now webview doesn't support client hints, which I consider a blocker for any UA reduction effort. But that will soon change (see https://groups.google.com/a/chromium.org/g/blink-dev/c/N_Y40YIHMtI). If and when we have a plan for webview reduction, we'll be sure to make it public and give devs plenty of time to prep for it/provide feedback, etc.

[miketaylr]

See also #219 (comment)

In particular we would like to see User-Agent Client Hints to indicate:

If the traffic is coming from a WebView
The source application that the browser session is coming from

The first would be covered by a hint that expressed "hey i'm a webview", and the second would be basically X-Requested-With, right? That was recently removed AFAIU: https://chromestatus.com/feature/5160086884843520

[jross1012]

That's right, it would be great to see this supported with Client Hints.

[miketaylr]

Note to self, this seems relevant: https://android-developers.googleblog.com/2023/02/improving-user-privacy-by-requiring-opt-in-to-send-x-requested-wih-header-from-webview.html

[Tanych]

the sec-ch-ua client hints already support to identify the traffic coming from WebView

for android it would be like:

• Sec-CH-UA: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
  for webview it would be like:
• Sec-CH-UA: "Android WebView";v="117", "Chromium";v="117", "Not;A=Brand";v="8"

[Shivaansh-Agarwal]

The sec-ch-ua is available but it doesn't seem to be a reliable approach as some browsers still don't support it.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-CH-UA#browser_compatibility

[bvattikonda]

Any update on this issue? Sec-CH-UA supports identifying traffic that is coming from webview. But, the issue of using client hints to identify source application remains unresolved.

[Tanych]

the app can override the user agent metadata to give their own client hints, e.g. they can add their own brand version: https://developer.android.com/reference/androidx/webkit/WebSettingsCompat#setUserAgentMetadata(android.webkit.WebSettings,androidx.webkit.UserAgentMetadata)

[bvattikonda]

Our request here is to make the contents of what used to be X-Requested-With a part of high entropy client hints by default. Unlike X-Requested-With the header will not be sent by default because it would be a high entropy client hint but at the same time it would be available for websites that would benefit from the value of the header.