Privacy issue: X-Edge-Shopping-Flag sent to bing.com

[RendijsSmukulis]

Description

When navigating to bing.com with an app that uses WebView2, the headers include an unexpected X-Edge-Shopping-Flag, which increase the likelihood the browser can be fingerprinted. Chromium does not include this header.

Version
SDK: 1.0.1619-prerelease
Runtime: Evergreen (109.0.1518.52)
Framework: WPF
OS: Win11 22H2 (OS Build 22621.521)

Repro Steps

• Open fiddler
• Navigate to bing.com
• Observe X-Edge-Shopping-Flag is present in the headers

AB#44083061

[ningccn]

thank you for your feedback for this issue. We will investigate.

[xu-ms]

@RendijsSmukulis
Thank you for your feedback. We investigated this issue. We have identified the root cause of the problem, and we will keep you updated on any further developments. Please let us know if you have any further questions or concerns in the meantime.

[novac42]

@RendijsSmukulis Update: as @xu-ms mentioned earlier we have identified the root cause, and the fix is in pipeline to remove the flag in the request header. And we just want to clarify that since shopping feature is disabled in WebView2, it doesn't provide additional information about the user's configuration, as all it does is to identify the client as Edge version >= min version that provides this header (which is already provided by the UA string). Please let us know if there's more concern. Thanks!

[champnic]

We've fixed this in runtimes version 113.0.1774.17+. Thanks!