@anonympins/fingerprint 0.0.3 → 0.0.5

package/README.md

@@ -2,7 +2,7 @@
 [![CI](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci.yml)
 [![Release](https://img.shields.io/github/v/release/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/releases)
 [![License](https://img.shields.io/github/license/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/blob/main/LICENSE)
-[![Downloads](https://img.shields.io/github/downloads/anonympins/fingerprint/total)](https://github.com/anonympins/fingerprint/releases)
+![GitHub commit activity](https://img.shields.io/github/commit-activity/w/anonympins/fingerprint)
 [![Watchers](https://img.shields.io/github/watchers/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/watchers)
 
 An HTTP(S) client mitigation and anti-bot protection library for Node.js/Express, based on digital fingerprinting and dynamic Proof-of-Work (PoW) challenges.
@@ -19,6 +19,7 @@ The process unfolds in three steps:
     *   **Device Behavior**: Rapid fingerprint changes (User-Agent rotation).
     *   **IP Behavior**: An excessive number of different devices seen from the same IP, or a single device using a large number of IPs (proxy rotation).
     *   **Inconsistency**: A low similarity score between the current fingerprint and the initial one associated with the `device_id` (cookie theft detection).
+    *   **Honeypot Trap**: Detection of bots that automatically fill hidden form fields or probe for common but unused URL parameters (e.g., `?debug=true`).
 3.  **Dynamic Challenge**: If the suspicion score exceeds a certain threshold, a challenge is presented to the user. The difficulty and type of challenge depend on the score:
     *   **Low to Medium Suspicion**: A combined CPU and Memory Proof-of-Work (PoW) challenge is issued. The difficulty of both the CPU (hash calculation) and Memory (allocation and computation) components scales progressively with the suspicion score. For low scores, the memory challenge is negligible, making it primarily a CPU task.
     *   **High Suspicion**: For the most suspicious requests, the system issues a high-difficulty combined CPU/Memory challenge. The architecture allows for plugging in more complex challenges like CAPTCHAs if needed.
@@ -30,7 +31,7 @@ Once the challenge is solved, a clearance "ticket" is issued via a secure cookie
 -   **Multi-Factor Fingerprinting**: Combines client-side data (`hardwareConcurrency`, `deviceMemory`, `screen`, `canvas`, `webgl`) and server-side data (`User-Agent`, `Client-Hints`).
 -   **Secure Ticket System**: Uses HMAC-SHA256 signatures to validate clearances and prevent tampering.
 -   **Pluggable Datastore**: Supports external datastores like Redis for state persistence and scalability across multiple server instances.
--   **Express.js Middleware**: Easy integration into an Express application with `powMiddleware`.
+-   **Express.js Middleware**: Easy integration into an Express application with `powMiddleware`. The datastore must support setting a Time-To-Live (TTL) for challenge secrets.
 -   **Timing Attack Protection**: Uses `crypto.timingSafeEqual` for secure ticket validation.
 -   **Automatic Threshold Tuning**: Includes a genetic algorithm-based optimizer (`startThresholdAutoTuning`) that analyzes real traffic to dynamically adjust suspicion thresholds (`low`, `medium`, `high`), improving bot detection accuracy and reducing false positives over time.
 
@@ -40,7 +41,7 @@ This module is designed for a Node.js environment.
 
 ### Prerequisites
 
-Ensure you have a cookie-parser middleware (like `cookie-parser`) set up in your Express application.
+Ensure you have middleware for parsing cookies (like `cookie-parser`) and request bodies (like `express.json` and `express.urlencoded`) set up in your Express application *before* the `powMiddleware`.
 
 ### Configuration
 
@@ -56,11 +57,14 @@ The `powMiddleware` requires a configuration object defining the weights of susp
 
 ```javascript
 import express from 'express';
+import bodyParser from 'body-parser';
 import cookieParser from 'cookie-parser';
 import { powMiddleware /*, configurePow */ } from './fingerprint.js'; // Adjust the path
 
 const app = express();
 app.use(cookieParser());
+app.use(bodyParser.json()); // For parsing application/json
+app.use(bodyParser.urlencoded({ extended: true })); // For parsing application/x-www-form-urlencoded
 
 // Configuration of weights and thresholds for calculating the suspicion score.
 // These values should be adjusted based on traffic and expected user behavior.
@@ -69,13 +73,25 @@ const securityConfig = {
         historyScore: 0.3,       // Penalizes IP rotation (proxy)
         rotationScore: 0.5,      // Penalizes rapid fingerprint changes (user-agent, etc.)
         headerAnomalyScore: 0.1, // Penalizes abnormal headers (missing UA, etc.)
-        inconsistencyScore: 0.8  // Strongly penalizes inconsistency between the current and initial fingerprint (stolen cookie)
+        inconsistencyScore: 0.8, // Strongly penalizes inconsistency between the current and initial fingerprint (stolen cookie)
+        honeypotScore: 1.0       // Strongly penalizes bots filling hidden form fields
     },
     thresholds: {
         low: 20,    // Score from which a CPU challenge is issued
         medium: 45, // Score for a more difficult combined CPU/Memory challenge
         high: 75,   // Score for a very difficult challenge
-        block: 95   // Score above which the request is blocked outright (HTTP 403)
+        block: 95,  // Score above which the request is blocked outright (HTTP 403)
+        isStaticResource: (req) => req.path.startsWith('/static/') // Optional: Custom function to identify static resources
+    },
+    honeypot: {
+        // List of field names that are traps for bots.
+        // These should be hidden in forms for humans, or be URL parameters your app never uses.
+        fields: ['email_confirm', 'user_nickname', 'debug', 'test_mode', 'admin'], // (Optional)
+        // List of URL paths that should never be accessed by a legitimate user.
+        // A request to one of these paths will immediately flag the device as malicious.
+        trapUrls: ['/wp-admin', '/.env', '/admin.php', '/phpmyadmin'], // (Optional)
+        // Automatically detect common SQL/NoSQL injection and RCE patterns in request values. (Optional, default: true)
+        detectInjections: true
     }
 };
 
@@ -222,9 +238,8 @@ const server = http.createServer(async (req, res) => {
         clientIp: req.socket.remoteAddress,
         path: req.url.split('?')[0],
         cookies: {}, // Parse cookies from req.headers.cookie
-        query: {},   // Parse query string from req.url
+        query: new URL(req.url, `http://${req.headers.host}`).searchParams,
         headers: req.headers,
-        isStatic: /\.(js|css|png)$/.test(req.url),
         rawReq: req, // Pass the raw request
         rawRes: res, // Pass the raw response for cookie setting
     };
@@ -261,35 +276,30 @@ Manually setting the `low`, `medium`, and `high` thresholds can be challenging.
 
 1.  **Enable Logging**: The auto-tuner needs data. You must provide a `logger` function in your security configuration. This function will be called for significant events (`challenge_issued`, `challenge_solved`, etc.).
 
-2.  **Start the Tuner**: Call `startThresholdAutoTuning` with your live security configuration and the array where logs are stored.
+2.  **Enable Auto-tuning**: Add an `autotuning` property to your security configuration. The middleware will automatically start the tuning process.
 
 ```javascript
-import { powMiddleware, startThresholdAutoTuning } from './fingerprint.js';
+import { powMiddleware } from './fingerprint.js';
 
 // Array to store traffic analysis data. In a real application, this could be
 // a more robust logging system.
 const trafficData = [];
 
 const securityConfig = {
-    weights: { /* ... your weights ... */ },
+    weights: { /* ... */ },
     thresholds: {
         low: 20,    // Initial values, will be optimized
         medium: 45,
         high: 75
     },
-    // The logger is required for auto-tuning
-    logger: (log) => trafficData.push(log)
+    logger: (log) => trafficData.push(log), // The logger is required for auto-tuning
+    autotune: {
+        trafficData: trafficData,       // The data source for the algorithm
+        interval: 1800000,              // Optimization cycle every 30 minutes (optional)
+        minDataPoints: 200              // Minimum requests before starting optimization (optional)
+    }
 };
 
-// Start the background optimization process.
-// The `securityConfig.thresholds` object will be mutated with optimized values.
-startThresholdAutoTuning({
-    securityConfig: securityConfig, // The config object to be updated
-    trafficData: trafficData,       // The data source for the algorithm
-    interval: 1800000,              // Optimization cycle every 30 minutes
-    minDataPoints: 200              // Minimum requests before starting optimization
-});
-
 const powMiddlewareInstance = powMiddleware(securityConfig);
 app.use(powMiddlewareInstance);
 ```

package/fingerprint.js

@@ -2,14 +2,49 @@
 import crypto from "node:crypto";
 import { Optimization } from "./library.js";
 import { cyrb53, FingerprintBuilder } from "./fingerprint.builder.js";
-import { getDeviceHash } from "./fingerprint.server.js";
 
-const POW_SECRET = process.env.POW_SECRET;
+/**
+ * Retrieves the POW_SECRET from environment variables with appropriate checks.
+ * @returns {string} The secret key.
+ */
+const getPowSecret = () => {
+  const secret = process.env.POW_SECRET;
+  if (!secret && process.env.NODE_ENV === 'production') {
+    throw new Error('POW_SECRET environment variable is not set. This is required for production.');
+  }
+  return secret || "fallback-dev-secret-32-chars-minimum";
+};
+
+/**
+ * Creates a stable hash based on device characteristics, independent of the IP.
+ * This is our "level 2 fingerprint".
+ * @param {object} context - The request context.
+ * @returns {string} A hash representing the device.
+ */
+function getHeaderSignature(context) {
+    if (!context.rawHeaders) return '';
+    const headerKeys = [];
+    for (let i = 0; i < context.rawHeaders.length; i += 2) {
+        headerKeys.push(context.rawHeaders[i]);
+    }
+    return cyrb53(headerKeys.join(','));
+}
+export function getDeviceHash(context) {
+    // Prioritize the rich client-side fingerprint if provided.
+    const clientFp = context.headers['x-device-fingerprint'];
+    if (clientFp && typeof clientFp === 'string' && clientFp.includes('cvs:')) {
+        // Basic validation to ensure it looks like our client-side fingerprint.
+        return clientFp;
+    }
 
-if (!POW_SECRET && process.env.NODE_ENV === 'production') {
-  throw new Error('POW_SECRET environment variable is not set. This is required for production.');
-} else if (!POW_SECRET) {
-  console.warn('Warning: POW_SECRET environment variable not set. Using a default, insecure secret for development.');
+    // Fallback to server-side only fingerprinting if the header is missing.
+    const srv = new FingerprintBuilder();
+    srv.add("ua", context.headers["user-agent"]);
+    if (context.headers["sec-ch-ua-platform"])
+        srv.add("os", context.headers["sec-ch-ua-platform"]);
+    if (context.headers["sec-ch-ua"]) srv.add("ch", context.headers["sec-ch-ua"]);
+    srv.add("h_ord", getHeaderSignature(context));
+    return srv.toString();
 }
 
 /**
@@ -289,7 +324,7 @@ export const verifyPoWAndGenerateTicket = (
   // 2. Generate an HMAC ticket so the client doesn't have to do it again for 1 hour
   const expiry = Date.now() + 3600000; // 1 heure
   const signature = crypto
-    .createHmac("sha256", POW_SECRET || "fallback-dev-secret-32-chars-minimum")
+    .createHmac("sha256", getPowSecret())
     .update(`${ip}:${expiry}`)
     .digest("hex");
 
@@ -300,18 +335,22 @@ export const verifyPoWAndGenerateTicket = (
  * Verifies a memory PoW solution.
  * The server performs the same calculation to validate.
  */
-export const verifyMemoryPoW = (nonce, solution, difficulty = 16) => {
+export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret) => {
   const size = difficulty * 1024 * 1024;
   const iterations = size / 16;
   const buffer = new Uint32Array(size / 4);
-  let h = new TextEncoder().encode(nonce).reduce((acc, v) => acc + v, 0);
+  const seed = clientSecret ? `${nonce}:${clientSecret}` : nonce;
+  let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
+
   for (let i = 0; i < buffer.length; i++) {
     buffer[i] = h = Math.imul(h ^ i, 1597334677);
   }
+
   let finalHash = 0;
+  let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
   for (let i = 0; i < iterations; i++) {
-    const addr = buffer[i % buffer.length] % buffer.length;
-    finalHash ^= buffer[addr];
+    addr = buffer[addr] % buffer.length;
+    finalHash ^= addr;
   }
   return finalHash === parseInt(solution, 10);
 };
@@ -320,7 +359,7 @@ export const isTicketValid = (ip, ticket) => {
   const [expiry, sig] = ticket.split(":");
   if (!expiry || !sig || Date.now() > parseInt(expiry, 10)) return false;
   const expectedSig = crypto
-    .createHmac("sha256", POW_SECRET || "fallback-dev-secret-32-chars-minimum")
+    .createHmac("sha256", getPowSecret())
     .update(`${ip}:${expiry}`)
     .digest("hex");
 
@@ -359,6 +398,122 @@ function getHeaderAnomalies(context) {
   };
 }
 
+/**
+ * Checks for submitted honeypot fields to detect bots.
+ * @param {object} context - The request context.
+ * @param {object} honeypotConfig - The honeypot configuration.
+ * @returns {{honeypotScore: number}}
+ */
+function getHoneypotScore(context, honeypotConfig = {}) {
+  const { fields = [], trapUrls = [], detectInjections = true } = honeypotConfig;
+
+  // 1. Check for trap URL access
+  if (trapUrls.some(trap => context.path.startsWith(trap))) {
+    return { honeypotScore: 100 };
+  }
+
+  if (fields.length === 0 && !detectInjections) {
+    return { honeypotScore: 0 };
+  }
+
+  // Check both query parameters (for URL probing) and the request body (for hidden form fields).
+  const queryData =
+    context.query instanceof URLSearchParams
+      ? Object.fromEntries(context.query.entries())
+      : context.query || {};
+  const bodyData = context.body || {};
+
+  // 2. Check for honeypot field names
+  for (const field of fields) {
+    // A bot is trapped if the field exists in either the query OR the body.
+    if (
+      Object.prototype.hasOwnProperty.call(queryData, field) ||
+      Object.prototype.hasOwnProperty.call(bodyData, field)
+    ) {
+      return { honeypotScore: 100 }; // A bot fell into the trap, maximum score.
+    }
+  }
+
+  // 3. Check for injection attempts in values
+  if (detectInjections) {
+    // Regex for common SQL injection patterns
+    const sqlRegex = new RegExp(
+      "('|\"|;|--|#|/\\*.*\\*/)|\\b(union|select|insert|update|delete|drop|truncate)\\b",
+      "i"
+    );
+    // Regex for common NoSQL (MongoDB) injection patterns (e.g., keys starting with '$')
+    const nosqlKeyRegex = /"\$[^"]*":/;
+    // Regex for common Remote Code Execution (RCE) patterns
+    const rceRegex = new RegExp(
+      // File traversal, command execution functions, and shell commands
+      "(\\.\\./|\\.\\.\\\\)|\\b(exec|system|shell_exec|passthru|popen|proc_open|eval|assert|require|include)(_once)?\\s*\\(|\\b(wget|curl|bash|sh|powershell)\\b",
+      "i"
+    );
+
+    const inspect = (obj) => {
+        for (const key in obj) {
+            if (Object.prototype.hasOwnProperty.call(obj, key)) {
+                const value = obj[key];
+                if (typeof value === 'string') {
+                    if (rceRegex.test(value) || sqlRegex.test(value)) return true;
+                } else if (typeof value === 'object' && value !== null) {
+                    // For NoSQL, we check the stringified version of the object to find keys like "$gt"
+                    // This is more accurate when done on the object itself.
+                    if (nosqlKeyRegex.test(JSON.stringify(value))) return true;
+                    if (inspect(value)) return true;
+                }
+            }
+        }
+        return false;
+    };
+
+    if (inspect(queryData)) {
+        return { honeypotScore: 100 };
+    }
+    if (inspect(bodyData)) {
+        return { honeypotScore: 100 };
+    }
+  }
+
+  return { honeypotScore: 0 };
+}
+
+const trapUrlTemplates = [
+    '/includes/config-{RANDOM}.php',          // Classic PHP config file
+    '/.env.{RANDOM}',                         // Environment file
+    '/backups/db_backup_{RANDOM}.sql.gz',     // Database backup
+    '/api/v1/internal/status?trace={RANDOM}', // Internal API endpoint
+    '/_private/deploy_key_{RANDOM}.pem',      // Private key file
+    '/logs/app_error_{RANDOM}.log',           // Log file
+    '/.git/config_{RANDOM}'                   // Exposed git config variant
+];
+
+/**
+ * Generates a signed trap URL.
+ * @param {string} nonce - The nonce to sign the URL with.
+ * @returns {string} The trap URL.
+ */
+function generateTrapUrl(nonce) {
+    // Pick a random template to diversify the traps
+    const template = trapUrlTemplates[Math.floor(Math.random() * trapUrlTemplates.length)];
+    const randomPart = crypto.randomBytes(8).toString('hex');
+    const path = template.replace('{RANDOM}', randomPart);
+
+    const signature = crypto.createHmac('sha256', getPowSecret()).update(nonce + path).digest('hex').substring(0, 16);
+    return `${path}?sig=${signature}`;
+}
+
+/**
+ * Verifies if a given path is a valid trap URL for a given nonce.
+ * @param {string} path - The request path.
+ * @param {string} signature - The signature from the query.
+ * @param {string} nonce - The nonce to verify against.
+ * @returns {boolean}
+ */
+function verifyTrapUrl(path, signature, nonce) {
+    const expectedSignature = crypto.createHmac('sha256', getPowSecret()).update(nonce + path).digest('hex').substring(0, 16);
+    return signature === expectedSignature;
+}
 /**
  * @typedef {object} IStore
  * @property {(key: string) => Promise<any>} get
@@ -369,7 +524,7 @@ function getHeaderAnomalies(context) {
 
 /**
  * Default in-memory store implementation.
- * @type {IStore} 
+ * @type {IStore}
  */
 const inMemoryStore = {
   _map: new Map(),
@@ -395,7 +550,7 @@ export const configureStore = (externalStore) => {
  * Orchestrates request identification using a persistent anchor (cookie)
  * and fingerprint verification.
  * @param {object} context - The request context.
- * @returns {Promise<{deviceId: string, deviceData: object, consistencyScore: number, newCookie: object|null}>} 
+ * @returns {Promise<{deviceId: string, deviceData: object, consistencyScore: number, newCookie: object|null}>}
  */
 async function resolveRequestIdentity(context) {
   const existingDeviceId = context.cookies?.device_id;
@@ -404,7 +559,6 @@ async function resolveRequestIdentity(context) {
   let consistencyScore = 1.0; // 1.0 = perfectly consistent
   let deviceData = null;
   let newCookie = null;
-
   if (deviceId) {
     deviceData = await store.get(`device:${deviceId}`);
   }
@@ -470,7 +624,7 @@ async function getBehavioralIndicators(context, deviceData) {
       deviceData.rapidChangeCount = Math.min(
         deviceData.rapidChangeCount + 1,
         MAX_RAPID_CHANGES_PER_DEVICE * 2, // Increases quickly
-      ); 
+      );
     } else {
       deviceData.rapidChangeCount = Math.max(0, deviceData.rapidChangeCount - 1); // Decreases slowly
     }
@@ -506,10 +660,10 @@ async function getBehavioralIndicators(context, deviceData) {
 /**
  * Returns a vector of raw (unweighted) suspicion scores.
  * @param {object} context - The request context object.
- * @returns {Promise<{historyScore: number, rotationScore: number, headerAnomalyScore: number, inconsistencyScore: number}>}
+ * @returns {Promise<{historyScore: number, rotationScore: number, headerAnomalyScore: number, inconsistencyScore: number, honeypotScore: number}>}
  */
-export const getSuspicionVector = async (context) => {
-  const { deviceId, deviceData, consistencyScore, newCookie } = await resolveRequestIdentity(context);
+export const getSuspicionVector = async (context, securityConfig) => {
+    const { deviceId, deviceData, consistencyScore, newCookie } = await resolveRequestIdentity(context);
 
   const clientIp = context.clientIp;
 
@@ -531,10 +685,11 @@ export const getSuspicionVector = async (context) => {
   const behavioral = await getBehavioralIndicators(context, deviceData);
   const { headerAnomalyScore } = getHeaderAnomalies(context);
   // Calculate the inconsistency score here, separately.
-  const inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200));
+  const inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200)); // Amplified score
 
 
   // Save the updated device state to the store
+  // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
   await store.set(`device:${deviceId}`, deviceData);
 
   return { ...behavioral, headerAnomalyScore, inconsistencyScore };
@@ -556,17 +711,20 @@ const MAX_RAPID_CHANGES_PER_DEVICE = 3; // Number of rapid fingerprint changes a
  * Uses FingerprintBuilder to create a fingerprint based on headers
  * and IP, making spoofing more complex (requires changing the entire stack).
  */
-export const identifyRequest = async (req, res) => {
+export const identifyRequest = (securityConfig) => async (req, res) => {
   // This function now acts as a lightweight wrapper around the engine's identifyRequest method.
   // It requires a default configuration to work.
-  const defaultConfig = {
-    weights: { historyScore: 0.3, rotationScore: 0.5, headerAnomalyScore: 0.1, inconsistencyScore: 0.8 },
-    thresholds: { low: 20, medium: 40, high: 75 }
+  const config = securityConfig || {
+    weights: { historyScore: 0.3, rotationScore: 0.5, headerAnomalyScore: 0.1, inconsistencyScore: 0.8, honeypotScore: 1.0 },
+    thresholds: { low: 20, medium: 40, high: 75 },
+    honeypot: { fields: [] } // Ensure honeypot config exists to prevent errors
   };
-  const engine = new FingerprintEngine(defaultConfig);
+  const engine = new FingerprintEngine(config);
 
   const requestContext = {
       clientIp: req.ip || req.socket?.remoteAddress || "unknown",
+      query: req.query,
+      body: req.body,
       cookies: req.cookies,
       headers: req.headers,
       rawHeaders: req.rawHeaders,
@@ -673,7 +831,7 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  * @param {string} clientIp - The client's IP address.
  * @returns {string} HTML content.
  */
-function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp) {
+function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret) {
     const { nonce, target, path } = cpuChallengeDetails;
     return `
       <html><head><title>Advanced Security Check</title></head>
@@ -685,13 +843,14 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
           async function solve() {
             const nonce = "${nonce}";
             const path = "${path}";
+            const clientSecret = "${clientSecret}"; // Secret is now available to the client
 
             // --- CPU Challenge ---
             document.getElementById('loader').innerText = '⚙️ Performing CPU security calculation...';
             const cpuTarget = BigInt("0x${target}");
             let cpuSolution = 0;
             while (true) {
-              const msg = "${clientIp}:${nonce}:" + cpuSolution;
+              const msg = "${clientIp}:${nonce}:" + cpuSolution + ":" + clientSecret;
               const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(msg));
               const hashHex = Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
               if (BigInt('0x' + hashHex) < cpuTarget) break;
@@ -706,12 +865,14 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
             let memSolution = 0;
             try {
                 const size = ${memoryDifficulty} * 1024 * 1024;
+                const iterations = size / 16;
                 const buffer = new Uint32Array(size / 4);
-                let h = new TextEncoder().encode(nonce).reduce((acc, v) => acc + v, 0);
+                const seed = nonce + ":" + clientSecret;
+                let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
                 for (let i = 0; i < buffer.length; i++) {
-                    buffer[i] = (h = Math.imul(h ^ i, 1597334677));
+                    buffer[i] = h = Math.imul(h ^ i, 1597334677);
                 }
-                for(let i = 0; i < (size / 16); i++) {
+                for(let i = 0; i < iterations; i++) {
                     const addr = buffer[i % buffer.length] % buffer.length;
                     memSolution ^= buffer[addr];
                 }
@@ -734,11 +895,13 @@ export function verifyCpuTargetPoWAndGenerateTicket(
   nonce,
   solution,
   suspicionFactor,
+  clientSecret, // Le secret est maintenant requis
 ) {
   const target = calculateTarget(suspicionFactor);
+  const message = clientSecret ? `${clientIp}:${nonce}:${solution}:${clientSecret}` : `${clientIp}:${nonce}:${solution}`;
   const hash = crypto
     .createHash("sha256")
-    .update(`${clientIp}:${nonce}:${solution}`)
+    .update(message)
     .digest("hex");
   const hashAsInt = BigInt("0x" + hash);
 
@@ -747,7 +910,7 @@ export function verifyCpuTargetPoWAndGenerateTicket(
     // The proof is valid, generate the ticket
     const expiry = Date.now() + 3600000; // 1 heure
     const signature = crypto
-      .createHmac("sha256", POW_SECRET || "fallback-dev-secret-32-chars-minimum")
+      .createHmac("sha256", getPowSecret())
       .update(`${clientIp}:${expiry}`)
       .digest("hex");
     return `${expiry}:${signature}`;
@@ -756,9 +919,11 @@ export function verifyCpuTargetPoWAndGenerateTicket(
   return null;
 }
 
-const staticExtensions =
-    /\.(js|css|png|jpg|jpeg|gif|svg|mp3|webp|ico|woff|woff2|ttf|otf|map)$/i;
-const isStaticResource = (req) => staticExtensions.test(req.path);
+const staticExtensions = new RegExp(
+  "\\.(js|css|png|jpg|jpeg|gif|svg|mp3|webp|ico|woff|woff2|ttf|otf|map)$",
+  "i",
+);
+const isStaticResource = (path) => staticExtensions.test(path);
 
 // --- Middleware Proof-of-Work (Le péage) ---
 class FingerprintEngine {
@@ -776,16 +941,27 @@ class FingerprintEngine {
       return { action: 'next', score: 0, vector: {} };
     }
 
+    // Check for persisted "condemned" status early.
+    const { deviceData } = await resolveRequestIdentity(requestContext);
+    if (deviceData?.condemned) {
+        return { action: 'block', status: 403, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+    }
+
     // The engine now works with the context directly, no more rawReq dependency here.
-    const suspicionVector = await __internal.getSuspicionVector(requestContext);
+    const suspicionVector = await __internal.getSuspicionVector(requestContext, this.securityConfig);
+    const { honeypotScore } = getHoneypotScore(requestContext, this.securityConfig.honeypot);
+    suspicionVector.honeypotScore = honeypotScore;
 
     const finalScore =
       suspicionVector.historyScore * (weights.historyScore || 0) +
       suspicionVector.rotationScore * (weights.rotationScore || 0) +
       suspicionVector.headerAnomalyScore * (weights.headerAnomalyScore || 0) +
-      suspicionVector.inconsistencyScore * (weights.inconsistencyScore || 0);
+      suspicionVector.inconsistencyScore * (weights.inconsistencyScore || 0) +
+      honeypotScore * (weights.honeypotScore || 0);
 
-    const isSuspiciousHigh = finalScore >= thresholds.high;
+    const isBlocked = finalScore >= (thresholds.block || 95);
+
+    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
     const isSuspiciousMedium = finalScore >= thresholds.medium;
     const isSuspicious = finalScore >= thresholds.low;
 
@@ -796,13 +972,41 @@ class FingerprintEngine {
             (finalScore - thresholds.low) / (thresholds.high - thresholds.low),
         )
         : 0;
-    const powCookie = cookies?.pow_clearance;    
+    const powCookie = cookies?.pow_clearance;
     const { pow_type, pow_nonce, pow_solution, pow_solution_cpu, pow_solution_mem } = query;
 
+    // Honeypot: Direct probing of challenge endpoints is highly suspicious.
+    // A legitimate user only hits these endpoints via the challenge page itself.
+    if (pow_nonce && !isSuspicious) {
+      if (logger) {
+          logger({ type: 'honeypot_probe', deviceId: cookies?.device_id, score: finalScore, path: path, timestamp: Date.now() });
+      }
+      suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
+      // Recalculate score and block immediately.
+      const newFinalScore = finalScore + (100 * (weights.honeypotScore || 0));
+      return { action: 'block', status: 403, body: 'Forbidden', score: newFinalScore, vector: suspicionVector };
+    }
+
+    // If the action is to block, we should still include the score and vector for logging/testing.
+    if (isBlocked) {
+      return { action: 'block', status: 403, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+    }
+
+    // Honeypot: Check if the request is for a trap URL generated in a previous challenge.
+    // This requires a nonce from a *previous* challenge, which we can look up via the device ID.
+    const lastNonce = deviceData?.lastChallengeNonce;
+    if (lastNonce && query.sig && verifyTrapUrl(path, query.sig, lastNonce)) {
+        deviceData.condemned = true; // This device is a bot. Condemn it.
+        await store.set(`device:${cookies.device_id}`, deviceData);
+        return { action: 'block', status: 403, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+    }
+
     if (isSuspicious && !isTicketValid(clientIp, powCookie)) {
         // --- CHALLENGE SOLUTION HANDLING ---
         if (pow_nonce && (pow_solution || (pow_solution_cpu && pow_solution_mem))) {
             let isValid = false,
+                // Retrieve the client-side secret associated with this nonce
+                clientSecret = await store.get(`secret:${pow_nonce}`),
                 ticket = null;
             if (pow_type === "cpu_target") {
                 // Verify the new type
@@ -810,25 +1014,20 @@ class FingerprintEngine {
                     clientIp,
                     pow_nonce,
                     pow_solution,
-                    suspicionFactor, // Pass the analog factor directly
+                    suspicionFactor, // Pass the analog factor
+                    clientSecret,
                 );
-                isValid = ticket !== null;
-            } else if (pow_type === "mem") {
-                const minDifficulty = 16; // 16Mo
-                const maxDifficulty = 48; // 48Mo
-                const difficulty =
-                    minDifficulty + suspicionFactor * (maxDifficulty - minDifficulty);
-                isValid = verifyMemoryPoW(pow_nonce, pow_solution, difficulty);
-            } else if (pow_type === "cpu_mem") {
+                isValid = ticket !== null;            } else if (pow_type === "cpu_mem") {
                 // Verify combined challenge
                 const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(
-                    clientIp, pow_nonce, pow_solution_cpu, suspicionFactor
+                    clientIp, pow_nonce, pow_solution_cpu, suspicionFactor, clientSecret
                 );
-
                 const minDifficulty = 16; // 16Mo
                 const maxDifficulty = 48; // 48Mo
-                const memDifficulty = minDifficulty + suspicionFactor * (maxDifficulty - minDifficulty);
-                const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, memDifficulty);
+                const memActivationFactor = Math.max(0, (suspicionFactor - 0.25) / 0.75);
+                const memDifficulty = Math.round(minDifficulty + memActivationFactor * (maxDifficulty - minDifficulty));
+
+                const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, memDifficulty, clientSecret);
 
                 isValid = cpuTicket !== null && isMemValid;
                 if (isValid) ticket = cpuTicket; // Reuse the ticket generated by the CPU verification
@@ -838,11 +1037,16 @@ class FingerprintEngine {
             }
 
             if (isValid) {
+                // The secret has been used, delete it to prevent replay.
+                if (clientSecret) {
+                    await store.delete(`secret:${pow_nonce}`);
+                }
+
                 if (!ticket) {
                     // If the ticket has not already been generated (CPU case)
                     const expiry = Date.now() + 3600000; // 1 heure
                     const signature = crypto
-                        .createHmac("sha256", POW_SECRET || "fallback-dev-secret-32-chars-minimum")
+                        .createHmac("sha256", getPowSecret())
                         .update(`${clientIp}:${expiry}`)
                         .digest("hex");
                     ticket = `${expiry}:${signature}`;
@@ -872,6 +1076,16 @@ class FingerprintEngine {
 
         // --- SELECTION AND SENDING OF THE APPROPRIATE CHALLENGE ---
         const nonce = crypto.randomBytes(16).toString("hex");
+        const clientSecret = crypto.randomBytes(16).toString("hex");
+
+        // Store the secret with a short TTL (e.g., 5 minutes)
+        await store.set(`secret:${nonce}`, clientSecret, 300);
+
+        // Associate the current challenge nonce with the device for trap URL verification later.
+        if (deviceData) {
+            deviceData.lastChallengeNonce = nonce;
+            await store.set(`device:${cookies.device_id}`, deviceData);
+        }
 
         if (logger) {
             logger({ type: 'challenge_issued', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now() });
@@ -882,24 +1096,14 @@ class FingerprintEngine {
             // ... logic for TSP/Captcha challenge
         }
 
-        // LEVEL 2: Memory-Intensive PoW
-        if (isSuspiciousMedium) {
-            // Utilisons notre nouveau challenge combiné !
-            const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path);
-            
-            const minMemDifficulty = 16; // 16Mo
-            const maxMemDifficulty = 48; // 48Mo
-            const memDifficulty = minMemDifficulty + suspicionFactor * (maxMemDifficulty - minMemDifficulty);
-
-            const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp);
-            return {
-                action: 'challenge', score: finalScore, vector: suspicionVector,
-                status: 429, body: page
-            };
-        }
-
-        // NOUVELLE LOGIQUE UNIFIÉE POUR TOUS LES NIVEAUX DE SUSPICION (low et medium)
+        // UNIFIED CHALLENGE LOGIC for all suspicion levels (low, medium, high)
         if (isSuspicious) { // Couvre à la fois low et medium
+            // Generate some trap URLs to embed in the challenge page.
+            // These links are visually hidden but present in the DOM to trap bots.
+            const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce));
+            const trapLinksHtml = trapUrls.map(url => `<a href="${url}" tabindex="-1">config</a>`).join(' ');
+
+
             const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path);
 
             // La difficulté mémoire démarre à 0 et augmente seulement après un certain seuil de suspicion.
@@ -908,10 +1112,11 @@ class FingerprintEngine {
 
             const minMemDifficulty = 0;   // Peut être 0 Mo !
             const maxMemDifficulty = 48;  // 48Mo pour les plus suspects
-            const memDifficulty = minMemDifficulty + memActivationFactor * (maxMemDifficulty - minMemDifficulty);
+            const memDifficulty = Math.round(minMemDifficulty + memActivationFactor * (maxMemDifficulty - minMemDifficulty));
 
-            // On utilise toujours la page combinée, même si la difficulté mémoire est 0 (le calcul sera quasi instantané).
-            const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp);
+            // Always use the combined page, even if memory difficulty is 0 (it will be almost instant).
+            const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;
+            const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret).replace('</body>', `${trapContainer}</body>`);
             return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 429, body: page };
         }
     }
@@ -956,12 +1161,14 @@ class FingerprintEngine {
     }
     await store.set(`ip:${clientIp}`, ipProfile);
 
-    const vector = await __internal.getSuspicionVector(requestContext);
+    const vector = await __internal.getSuspicionVector(requestContext, this.securityConfig); // Pass the config
+    const { honeypotScore } = getHoneypotScore(requestContext, this.securityConfig.honeypot);
     const score =
       vector.historyScore * (this.securityConfig.weights.historyScore || 0.3) +
       vector.rotationScore * (this.securityConfig.weights.rotationScore || 0.5) +
       vector.headerAnomalyScore * (this.securityConfig.weights.headerAnomalyScore || 0.1) +
-      vector.inconsistencyScore * (this.securityConfig.weights.inconsistencyScore || 0.8);
+      vector.inconsistencyScore * (this.securityConfig.weights.inconsistencyScore || 0.8) +
+      honeypotScore * (this.securityConfig.weights.honeypotScore || 0);
 
     if (score >= this.securityConfig.thresholds.high) return `suspicious_high:${clientIp}`;
     if (score >= this.securityConfig.thresholds.low) return `suspicious_medium:${clientIp}`; // Use medium for any suspicion
@@ -979,14 +1186,22 @@ class FingerprintEngine {
 export const powMiddleware = (securityConfig) => {
   const engine = new FingerprintEngine(securityConfig);
 
+  if (securityConfig.autotuning) {
+    startThresholdAutoTuning({
+      securityConfig: securityConfig,
+      ...securityConfig.autotuning,
+    });
+  }
+
   return async (req, res, next) => {
     const requestContext = {
       clientIp: req.ip || req.socket?.remoteAddress || "unknown",
       path: req.path,
       cookies: req.cookies,
       query: req.query,
+      body: req.body,
       headers: req.headers,
-      isStatic: isStaticResource(req),
+      isStatic: isStaticResource(req.path),
       // Add the newly required properties for full decoupling
       rawHeaders: req.rawHeaders,
       httpVersion: req.httpVersion,

package/package.json

@@ -1,47 +1,48 @@
-{
-  "name": "@anonympins/fingerprint",
-  "version": "0.0.3",
-  "description": "An HTTP(S) client mitigation and anti-bot protection library for Node.js/Express, based on digital fingerprinting and dynamic Proof-of-Work (PoW) challenges.",
-  "main": "fingerprint.js",
-  "type": "module",
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "scripts": {
-    "test": "vitest run"
-  },
-  "files": [
-    "fingerprint.js",
-    "library.js",
-    "README.md",
-    "LICENSE"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/anonympins/fingerprint.git"
-  },
-  "keywords": [
-    "fingerprint",
-    "bot",
-    "anti-bot",
-    "security",
-    "express",
-    "middleware",
-    "proof-of-work",
-    "pow",
-    "rate-limiting",
-    "mitigation",
-    "captcha"
-  ],
-  "author": "anonympins",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/anonympins/fingerprint/issues"
-  },
-  "homepage": "https://github.com/anonympins/fingerprint#readme",
-  "devDependencies": {
-    "cookie-parser": "^1.4.6",
-    "express": "^4.18.2",
-    "vitest": "^4.1.11"
-  }
-}
+{
+  "name": "@anonympins/fingerprint",
+  "version": "0.0.5",
+  "description": "An HTTP(S) client mitigation and anti-bot protection library for Node.js/Express, based on digital fingerprinting and dynamic Proof-of-Work (PoW) challenges.",
+  "main": "fingerprint.js",
+  "type": "module",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "test": "vitest run"
+  },
+  "files": [
+    "fingerprint.js",
+    "library.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/anonympins/fingerprint.git"
+  },
+  "keywords": [
+    "fingerprint",
+    "bot",
+    "anti-bot",
+    "security",
+    "express",
+    "middleware",
+    "proof-of-work",
+    "pow",
+    "rate-limiting",
+    "mitigation",
+    "captcha"
+  ],
+  "author": "anonympins",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/anonympins/fingerprint/issues"
+  },
+  "homepage": "https://github.com/anonympins/fingerprint#readme",
+  "devDependencies": {
+    "body-parser": "^1.20.2",
+    "cookie-parser": "^1.4.6",
+    "express": "^4.18.2",
+    "vitest": "^4.1.11"
+  }
+}