This feature has been suspended; we've ended the experiments removing the HTTP header as we were unable to provide a sufficient alternative, resulting in breakage to important abuse and fraud prevention use cases. --- Removes the default X-Requested-With header from HTTP requests made by WebView. The X-Requested-With header is set by WebView, with the package name of the embedding apk as the value. This use of the header will be discontinued. Developers who rely on this header can sign up for a deprecation origin trial [1] to continue to receive the header during the deprecation period. The deprecation origin trial will be extended until replacement APIs are available to address use cases of the header, as explained in this Android Developer Blog Post [2] [1]: https://developer.chrome.com/origintrials/#/view_trial/1390486384950640641 [2]: https://android-developers.googleblog.com/2023/02/improving-user-privacy-by-requiring-opt-in-to-send-x-requested-wih-header-from-webview.html
The header as implemented in WebView does not follow the principle of meaningful consent of all parties exchanging the information[1]. Developer can utilize unreliable and undocumented methods to opt-out. Users are not provided with an opt-out option. The content owner is the only party with full control over the information provided in the header. APK name is also an abundant source of passive fingerprinting information about the users. It contains specific information about the browsing context. When the application is not omnipresent (i.e. has a relatively small user base), together with other information (e.g. approx. geolocation based on an IP address), it can provide a fairly unique identifier of a user. On top of those privacy issues, the header is undocumented, used in non-WebView context for a completely different purpose, notoriously misunderstood, and causing security issues since its introduction. [1]: https://w3ctag.github.io/design-principles/#consent