Layer7 API Management

Expand all | Collapse all

On API gateway, how to tell if a request is from a webview or not?

Jump to Best Answer
  • 1.  On API gateway, how to tell if a request is from a webview or not?

    Posted 02-03-2017 11:45 AM

    Hey there, 

     

    Please help us find a way to tell if a web request is from a mobile webview or from a web browser? It seems the user-agent field from either one does not help, because we can see the same user-agent from either one. 

     

    Comments are welcome!

    Thanks,

    Peter



  • 2.  Re: On API gateway, how to tell if a request is from a webview or not?

    Broadcom Employee
    Posted 02-05-2017 06:35 PM

    I believe you need to add extra info in the request to identify the requests from an app.

    You may consider an extra header, or replace the user-agent header in the app.



  • 3.  Re: On API gateway, how to tell if a request is from a webview or not?

    Posted 02-07-2017 04:20 PM

    This is possible if we have control of the client application, but in this case we do not.  Is there a way to reliably identify if requests comes in thru a native browser in preference over a webview?  If not, will this be possible with a future version of the CA Gateway stack?  

     

    Areas of concern with webviews are that they are still controlled by the underlying app, and requires more trust that the underlying app is not compromised or maliciously stores sensitive information displayed to or entered by the user.



  • 4.  Re: On API gateway, how to tell if a request is from a webview or not?
    Best Answer

    Broadcom Employee
    Posted 02-07-2017 04:40 PM

    Hi votron,

     

    It seems in Android 5.0 [Lollipop] and above "wv" was added to the user-agent header to denote a webview.

    User Agent Strings - Google Chrome 

     

    Mozilla/5.0 (Linux; Android 5.1.1; Nexus 5 Build/LMY48B; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/43.0.2357.65 Mobile Safari/537.36

    Not a complete solution but may be helpful in your testing. You may want to create an 'idea' for an enhancement. 

     

    Regards,

    Joe