哪些请求标头可用于浏览器/客户端指纹? [英] Which request headers can be used for a browser/client fingerprint?
本文介绍了哪些请求标头可用于浏览器/客户端指纹?的处理方法,对大家解决问题具有一定的参考价值,需要的朋友们下面随着小编来一起学习吧!
问题描述
为了增强安全性,我们的服务器会跟踪浏览器指纹.目前,我们使用以下标头:
For added security our server keeps track of the browser fingerprint. At the moment we use the following headers:
- 'HTTP_CLIENT_IP','HTTP_X_FORWARDED_FOR','HTTP_X_FORWARDED','HTTP_X_CLUSTER_CLIENT_IP','HTTP_FORWARDED_FOR','HTTP_FORWARDED','REMOTE_ADDR'(将第一个非空作为客户端IP)
- HTTP_ACCEPTxxxx
- HTTP_USER_AGENT
还有更多(可选)标题可以使用吗?
Are there any more (optional) headers that can be used?
通常,什么是计算客户端指纹的最佳算法"?
What in general is the best 'algorithm' to calculate the client fingerprint?
推荐答案
您可以使用唯一的浏览器指纹(用户代理,Web浏览器,画布等),并在获取哈希之后.
you can use a unique browser fingerprint (user agent, web browser, canvas, etc) and after get the hash.
/* Generate a fingerprint string for the browser */
function generateFingerprint(){
//Generate a string based on "stable" information taken from the browser
//We call here "stable information", information that normally don't change during the user
//browse the application just after authentication
var fingerprint = [];
//Take plugins
for(var i = 0; i < navigator.plugins.length; i++){
fingerprint.push(navigator.plugins[i].name);
fingerprint.push(navigator.plugins[i].filename);
fingerprint.push(navigator.plugins[i].description);
fingerprint.push(navigator.plugins[i].version);
}
//Take User Agent
fingerprint.push(navigator.userAgent);
//Take Screen resolution
fingerprint.push(screen.availHeight);
fingerprint.push(screen.availWidth);
fingerprint.push(screen.colorDepth);
fingerprint.push(screen.height);
fingerprint.push(screen.pixelDepth);
fingerprint.push(screen.width);
//Take Graphical card info
//See http://output.jsbin.com/ovekor/3/
try {
//Add a Canvas element if the body do not contains one
if ( $("#glcanvas").length == 0 ){
$(document.body).append("<canvas id='glcanvas'></canvas>");
}
//Get ref on Canvas
var canvas = document.getElementById("glcanvas");
//Retrieve Canvas properties
gl = canvas.getContext("experimental-webgl");
gl.viewportWidth = canvas.width;
gl.viewportHeight = canvas.height;
fingerprint.push(gl.getParameter(gl.VERSION));
fingerprint.push(gl.getParameter(gl.SHADING_LANGUAGE_VERSION));
fingerprint.push(gl.getParameter(gl.VENDOR));
fingerprint.push(gl.getParameter(gl.RENDERER));
fingerprint.push(gl.getSupportedExtensions().join());
} catch (e) {
//Get also error because it's will be stable too..
fingerprint.push(e);
}
//Last and, in order to made this browser unique, generate a random ID that we will store
//in local storage (in order to be persistent after browser close/reopen)
//Add this ID because, in Enterprise, most of the time browser have the same configuration
var browserUniqueID = localStorage.getItem("browserUniqueID");
if (browserUniqueID === null) {
localStorage.setItem("browserUniqueID", CryptoJS.lib.WordArray.random(80));
browserUniqueID = localStorage.getItem("browserUniqueID");
}
fingerprint.push(browserUniqueID);
return fingerprint.join();
}
最后获取哈希并将其发送到服务器.
And finally get the hash and sent to the server.
//Call the fingerprint dedicated function
var fingerprint = generateFingerprint();
//Use CryptoJS library ot generate a hex encoded string of the hash of the fingerprint
var fingerprintHash = CryptoJS.SHA256(fingerprint);
来源: https://www.owasp.org/index.php/JSON_Web_Token_(JWT)_Cheat_Sheet_for_Java#Token_sidejacking https://browserleaks.com/canvas
这篇关于哪些请求标头可用于浏览器/客户端指纹?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!
查看全文