Background

• Previously, when someone visited a page on a Patch Demo wiki, that person's User-Agent header was passed through to that wiki.
• As Patch Demo wikis are (by their nature) publicly accessible/publicly usable, this meant that end-users' User-Agents could be publicly accessed by way of the CheckUser extension. This was reported in security task T385156: Patch Demo can publicly reveal User-Agents via the CheckUser extension.
• To resolve that issue, Apache configuration was added to strip the User-Agent header from all incoming requests to Patch Demo wikis.

This task

Due to the fact that the Wikibase REST API currently requires inbound requests to include a User-Agent header, stripping the UA header means that this API is (by default) no longer effectively functional on Patch Demo wikis. @Silvan_WMDE has therefore requested that Patch Demo includes a fake User-Agent header, rather than stripping it entirely.

In T385156#11057842, @Silvan_WMDE wrote:

In T385156#10706486, @thcipriani wrote:

That's a good call. We're using apache for both the wikis. I tested CheckUser just now enabling mod_headers with RequestHeader unset User-Agent and that gets rid of the user agent.

Unfortunately, this breaks the Wikibase REST API on PatchDemo. As per T318151: 🥐 Require clients to identify themselves by providing User-Agent header, Wikibase rejects REST requests with missing or empty User-Agent headers.

We could also fake one if that's helpful for developers.

That would be helpful, indeed.