See previous discussion in syncthing/syncthing-android#1982 (comment)

Currently, the app uses a rather ugly hack to open the web UI without prompting for credentials. During startup the username and password is always reset, which tends to confuse users as in syncthing/syncthing-android#1710

This is only necessary because the WebView previously relied only on intercepting the HTTP basic auth prompt. With the changes in syncthing/syncthing-android#1982 we can send any HTTP header in the initial request.

My suggestion would be to change the app to use bearer authorization with the API key as described in https://docs.syncthing.net/dev/rest.html#api-key. While this works for the first request to /, it doesn't set a session cookie, which is necessary for subsequent requests because they lack the initial header.

As this would also affect calls to the REST API, we could exempt them or limit this to / and /index.html.

Pseudo code:

if hasValidAPIKeyHeader(r, guiCfg) {
		
	if isUIPath(r.URL.Path) {
	    createApiKeySession(cookieName, guiCfg, w, r)
	}
	
	next.ServeHTTP(w, r)
	return
}