Is there a way to suppress sec-ua* headers in Chrome?

I was not successful in getting a web application rendered with its mobile friendly interface by using the User-Agent Switcher & Manager extension. After further digging, I noted that although the browser identifies itself as a mobile device through the user-agent string, the sec-ua-* headers still persist and leak the correct platform to the server:

sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="97", "Chromium";v="97"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"

Based on this, I am assuming the application is returning the desktop version of the application to the user.

Is there any method to suppress the browser sending these headers in its requests (other than getting an old browser)? Launching Chrome with the --disable-features=UserAgentClientHint did disable these headers.

The feature flag for disabling client hints is gone as a result of commit 7cb7681 (see also issue tracker item #41491818). I'm not aware of a good / user-friendly way to disable this now*- at least- not via configuring Chrome (aside from forking it and removing the bits that implement this).

At the time of this writing there does seem to be some mechanism in Android to override them, but I'm not sure how it works. Related code (locked to latest commit at time of this writing) is here. See also related review ticket #4781571 and related email thread.

Fun but not very helpful fact: When (and only when) you have devtools open, you can spoof Client Hints in the "Network conditions" tab (go to "User agent" section, and expand the section on "User agent client hints").

* See also Can I modify outgoing request headers with a Chrome Extension?. The top answer there shows how a Chrome extension can intercept outgoing request headers and remove them.

I'm not sure what extensions allow this, though you can probably pretty easily find some. uBlock Origin probably won't.

Recommended topics

Hot tags