Please help us find a way to tell if a web request is from a mobile webview or from a web browser? It seems the user-agent field from either one does not help, because we can see the same user-agent from either one.
Comments are welcome!
I believe you need to add extra info in the request to identify the requests from an app.
You may consider an extra header, or replace the user-agent header in the app.
This is possible if we have control of the client application, but in this case we do not. Is there a way to reliably identify if requests comes in thru a native browser in preference over a webview? If not, will this be possible with a future version of the CA Gateway stack?
Areas of concern with webviews are that they are still controlled by the underlying app, and requires more trust that the underlying app is not compromised or maliciously stores sensitive information displayed to or entered by the user.
It seems in Android 5.0 [Lollipop] and above "wv" was added to the user-agent header to denote a webview.
User Agent Strings - Google Chrome
Mozilla/5.0 (Linux; Android 5.1.1; Nexus 5 Build/LMY48B; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/43.0.2357.65 Mobile Safari/537.36
Not a complete solution but may be helpful in your testing. You may want to create an 'idea' for an enhancement.