head - Dave's Blog

Search
My timeline on Mastodon

Changing the User Agent string in UWP WebView

2018 Oct 23, 9:32

There's no perfect way to change the user agent string for the UWP WebView (x-ms-webview in HTML, Windows.UI.Xaml.Controls.WebView in XAML, and Windows.Web.UI.Interop.WebViewControl in Win32) but there are two imperfect methods folks end up using.

The first is to call UrlMkSetSessionOption. This is an old public API that allows you to configure various arcane options including one that is the default user agent string for requests running through urlmon. This API is allowed by the Microsoft Store for UWP apps. The change it applies is process wide which has two potential drawbacks. If you want to be able to have different UA strings set for different requests from a WebView that's not really possible with this solution. The other drawback is if you're using out of process WebView, you need to ensure you're calling into UrlMkSetSessionOption in the WebView's process. You'll need to write third party WinRT that calls UrlMkSetSessionOption, create the out of proc WebView, navigate it to some trusted local page, use AddWebAllowedObject or provide that URI WinRT access, and call into your third party WinRT. You'll need to do that for any new WebView process you create.

The second less generally applicable solution is to use NavigateWithHttpRequestMessage and set the User-Agent HTTP header. In this case you get to control the scope of the user agent string changes but has the limitations that not all sub resource downloads will use this user agent string and for navigations you don't initiate you have to manually intercept and re-request being careful to transfer over all POST body state and HTTP headers correctly. That last part is not actually possible for iframes.

PermalinkCommentsuser-agent uwp webview

Tweet from David Risney

2016 Dec 4, 3:47
Astounding realization during Westworld finale: My wife doesn't care that I can identify all the Radiohead cover titles played on Westworld.
PermalinkComments

Tweet from Šime Vidas

2016 Nov 17, 3:14
Chrome Canary has enabled scroll anchoring which prevents “jumps” when the layout above the viewport changes (demo: https://output.jsbin.com/parujo/quiet#heading2 )
PermalinkComments

Tweet from Present & Correct

2016 Oct 12, 8:33
Screw Head Typology.
PermalinkComments

Tweet from Benedict Evans

2016 May 11, 12:54
‘Which VR headset do you have?
PermalinkComments

Let's Encrypt NearlyFreeSpeech.net Setup

2016 Feb 4, 2:48

2016-Nov-5: Updated post on using Let's Encrypt with NearlyFreeSpeech.net

I use NearlyFreeSpeech.net for my webhosting for my personal website and I've just finished setting up TLS via Let's Encrypt. The process was slightly more complicated than what you'd like from Let's Encrypt. So for those interested in doing the same on NearlyFreeSpeech.net, I've taken the following notes.

The standard Let's Encrypt client requires su/sudo access which is not available on NearlyFreeSpeech.net's servers. Additionally NFSN's webserver doesn't have any Let's Encrypt plugins installed. So I used the Let's Encrypt Without Sudo client. I followed the instructions listed on the tool's page with the addition of providing the "--file-based" parameter to sign_csr.py.

One thing the script doesn't produce is the chain file. But this topic "Let's Encrypt - Quick HOWTO for NSFN" covers how to obtain that:

curl -o domain.chn https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem

Now that you have all the required files, on your NFSN server make the directory /home/protected/ssl and copy your files into it. This is described in the NFSN topic provide certificates to NFSN. After copying the files and setting their permissions as described in the previous link you submit an assistance request. For me it was only 15 minutes later that everything was setup.

After enabling HTTPS I wanted to have all HTTP requests redirect to HTTPS. The normal Apache documentation on how to do this doesn't work on NFSN servers. Instead the NFSN FAQ describes it in "redirect http to https and HSTS". You use the X-Forwarded-Proto instead of the HTTPS variable because of how NFSN's virtual hosting is setup.

RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R=301]

Turning on HSTS is as simple as adding the HSTS HTTP header. However, the description in the above link didn't work because my site's NFSN realm isn't on the latest Apache yet. Instead I added the following to my .htaccess. After I'm comfortable with everything working well for a few days I'll start turning up the max-age to the recommended minimum value of 180 days.

Header set Strict-Transport-Security "max-age=3600;" 

Finally, to turn on CSP I started up Fiddler with my CSP Fiddler extension. It allows me to determine the most restrictive CSP rules I could apply and still have all resources on my page load. From there I found and removed inline script and some content loaded via http and otherwise continued tweaking my site and CSP rules.

After I was done I checked out my site on SSL Lab's SSL Test to see what I might have done wrong or needed improving. The first time I went through these steps I hadn't included the chain file which the SSL Test told me about. I was able to add that file to the same files I had already previously generated from the Let's Encrypt client and do another NFSN assistance request and 15 minutes later the SSL Test had upgraded me from 'B' to 'A'.

PermalinkCommentscertificate csp hsts https lets-encrypt nearlyfreespeech.net

JavaScript Types and WinRT Types

2016 Jan 21, 5:35PermalinkCommentschakra development javascript winrt

Retweet of anildash

2016 Jan 3, 9:59
Oh! @jsnell is way ahead of me: https://sixcolors.com/post/2015/12/the-best-christmas-gift-in/ … Programming BB-8 with a kid-friendly app! Thanks to @anoopr for the link.
PermalinkComments

Retweet of cwilso

2015 Nov 19, 8:28
Hell yes. I am so proud of my state's governor @GovInslee. http://www.nytimes.com/2015/11/21/opinion/why-my-state-wont-close-its-doors-to-syrian-refugees.html … (via @ericlaw).
PermalinkComments

Retweet of marypcbuk

2015 Nov 1, 10:45
@SwiftOnSecurity monthly subscription. not being run over as a service
PermalinkComments

Tweet from David_Risney

2015 Oct 19, 9:29
Klingon Forehead Problem: TOS no makeup, no ridges. TNG+ ridges. ENT S4 retcons the answer of virus http://www.ex-astris-scientia.org/inconsistencies/klingon-foreheads.htm …
PermalinkComments

Tweet from David_Risney

2015 Oct 13, 9:43
Neat hack: use victim's headphone wire as antenna to send audio commands to their phone's Siri http://www.wired.com/2015/10/this-radio-trick-silently-hacks-siri-from-16-feet-away/ …
PermalinkComments

Retweet of shinyemptyhead

2015 Jul 19, 10:58
@rajcardwell @cstross Here's the specific letter in the files that screamed "Laundry!" at me. pic.twitter.com/FSYjc4OuQ0
PermalinkComments

Tweet from David_Risney

2015 Apr 2, 10:43
Tesla's April fools headline fooled stock trading algorithms causing $1.50 jump: http://www.bloombergview.com/articles/2015-04-02/tesla-stockholders-can-t-take-a-joke …
PermalinkComments

Retweet of verge

2015 Apr 2, 6:22
Max Headroom: the definitive history of the 1980s digital icon http://theverge.com/e/8049180  pic.twitter.com/ZRLbVJrRBO
PermalinkComments

Retweet of secretGeek

2015 Apr 2, 5:00
So a centralized website for managing distributed repos is being hit by a distributed attack.
PermalinkComments

Retweet of shaver

2015 Feb 20, 4:19
Facebook Security published a note with some info on Superfish: https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339 …
PermalinkComments

Tweet from David_Risney

2015 Feb 12, 1:02
The Verge explains and demos binaural audio in which a dummy head with two mics records audio as if you were there: https://www.youtube.com/watch?v=Yd5i7TlpzCk …
PermalinkComments

Retweet of BoingBoing

2015 Feb 4, 8:08
Portraits of every U.S. vice president—with an octopus on their head (or in their mouth) http://boingboing.net/2015/02/04/portraits-of-every-u-s-vice-p.html … pic.twitter.com/aqUrk4BrRm
PermalinkComments

David_Risney: Egg toy unboxing youtube videos made millions via advertising. My 3yo is already ahead of me on what's hip.

2015 Jan 20, 9:08
David Risney @David_Risney :
Egg toy unboxing youtube videos made millions via advertising. My 3yo is already ahead of me on what's hip. http://finance.yahoo.com/news/youtube-s-highest-paid-star-is-a-woman-who-unboxes-disney-toys-062606350.html …
PermalinkComments
Older Entries Creative Commons License Some rights reserved.