A significant fraction of the requests to my webserver over the last few months are from a single user requesting /favicon.ico:
# tail -n 3 access_log
XXX - - [24/Jan/2021:17:40:18 +0000] "GET /favicon.ico HTTP/1.1" 200 1845 "-" "WidgetKitExtension/3279 CFNetwork/1209 Darwin/20.2.0" "-"
XXX - - [24/Jan/2021:17:41:22 +0000] "GET /favicon.ico HTTP/1.1" 200 1845 "-" "WidgetKitExtension/3279 CFNetwork/1209 Darwin/20.2.0" "-"
XXX - - [24/Jan/2021:17:41:25 +0000] "GET /favicon.ico HTTP/1.1" 200 1845 "-" "WidgetKitExtension/3279 CFNetwork/1209 Darwin/20.2.0" "-"
(I've censored the IP address.) This is a legitimate user, with occasional human requests (with a different user agent and over http/2) to the site. The most recent human visit was several weeks ago, but the /favicon.ico requests continue unabated, on average four times an hour but often every few minutes or seconds, as seen above. In particular, the favicon.ico requests are not associated with requests to any other resources on the site. I don't know if it's relevant, but the favicon is being served over https (I believe there are no corresponding http requests) and appears to be compressed, as favicon.ico.gz is 1599 bytes.
In searching I've seen a variety of other questions about all sorts of weird favicon.ico request patterns but nothing that explains favicon.ico requests in absence of ordinary web requests.
What could be responsible for these excessive requests? I assume it is some kind of configuration problem by the user agent, but is there some change in server configuration I can do to persuade the user agent to cache the favicon? The server is using nginx. Thanks.