@anonympins/fingerprint 0.3.2 → 0.3.4

package/src/php/Config/SecurityProfiles.php

@@ -0,0 +1,267 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Config;
+
+/**
+ * Définit les profils de sécurité prédéfinis pour la bibliothèque Fingerprint.
+ * Ces profils contiennent les poids des scores de suspicion et les seuils de déclenchement.
+ */
+class SecurityProfiles
+{
+    /**
+     * @var array<string, array<string, mixed>>
+     */
+    public const PROFILES = [
+        /**
+         * Balanced Profile (Default)
+         * A general-purpose configuration suitable for most websites, offering a good mix of security and user experience.
+         * It's sensitive enough to catch common bots without being overly aggressive towards legitimate users.
+         */
+        'balanced' => [
+            'summary' => 'Balanced Profile (Default)',
+            'description' => 'A general-purpose configuration suitable for most websites, offering a good mix of security and user experience. It\'s sensitive enough to catch common bots without being overly aggressive towards legitimate users.',
+            'weights' => [
+                'historyScore' => 0.3,
+                'rotationScore' => 0.5,
+                'headerAnomalyScore' => 0.1,
+                'requestPatternScore' => 0.6,
+                'inconsistencyScore' => 0.8,
+                'behaviorScore' => 0.7,
+                'honeypotScore' => 1.0,
+                'crossLayerInconsistencyScore' => 0.4,
+                'timeInconsistencyScore' => 0.9,
+                'tlsSpoofingScore' => 0.8,
+                'botScore' => 1.0, // Poids pour le score de bot explicite
+                'cookieDroppingScore' => 0.9, // Pénalité élevée pour la suppression de cookies
+                'threatIntelScore' => 0.4, // Poids pour le renseignement sur les menaces (ex: IP de proxy connu)
+                'clientHintsInconsistencyScore' => 0.7, // Penalizes inconsistency between User-Agent and Client-Hints
+                'clickVarianceScore' => 0.6, // Poids pour la variance des clics
+                'subnetScore' => 0.5, // Pénalise les sous-réseaux IP avec une activité suspecte agrégée
+            ],
+            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95],
+            'patterns' => [
+                'velocityThreshold' => 800,
+                'burstThreshold' => 1500,
+                'scrapeThreshold' => 1000,
+                'historySize' => 10,
+                'minSamples' => 5,
+                'regularityThreshold' => 50,
+                'benfordThreshold' => 0.15,
+                'patternWeight' => 80,
+                'decayFactor' => 0.9,
+                'inactivityReset' => 5000,
+            ],
+        ],
+
+        /**
+         * Strict Profile
+         * An aggressive configuration for sensitive applications (e.g., financial services, admin panels).
+         * It uses lower suspicion thresholds and higher penalties for anomalies, prioritizing security over user convenience.
+         * All new devices are challenged by default.
+         */
+        'strict' => [
+            'summary' => 'Strict Profile',
+            'description' => 'An aggressive configuration for sensitive applications (e.g., financial services, admin panels). It uses lower suspicion thresholds and higher penalties for anomalies, prioritizing security over user convenience. All new devices are challenged by default.',
+            'weights' => [
+                'historyScore' => 0.4,
+                'rotationScore' => 0.6,
+                'headerAnomalyScore' => 0.2,
+                'requestPatternScore' => 0.8,
+                'inconsistencyScore' => 1.0,
+                'behaviorScore' => 0.8,
+                'honeypotScore' => 1.0,
+                'crossLayerInconsistencyScore' => 0.6,
+                'timeInconsistencyScore' => 1.0,
+                'tlsSpoofingScore' => 1.0,
+                'botScore' => 1.0,
+                'cookieDroppingScore' => 1.0, // Pénalité maximale
+                'threatIntelScore' => 0.7, // Poids élevé pour les menaces connues (Tor, etc.)
+                'clientHintsInconsistencyScore' => 0.9, // Very high penalty in strict mode
+                'clickVarianceScore' => 0.7, // High weight for click variance
+                'subnetScore' => 0.7, // Poids plus élevé en mode strict
+            ],
+            'thresholds' => ['low' => 10, 'medium' => 35, 'high' => 65, 'block' => 90],
+            'patterns' => [
+                'velocityThreshold' => 1000,
+                'burstThreshold' => 1800,
+                'scrapeThreshold' => 1200,
+                'historySize' => 15,
+                'minSamples' => 4,
+                'regularityThreshold' => 40,
+                'benfordThreshold' => 0.12,
+                'patternWeight' => 90,
+                'decayFactor' => 0.85,
+                'inactivityReset' => 4000,
+            ],
+            'challengeNewDevices' => true, // Challenge all new devices
+        ],
+
+        /**
+         * API Profile
+         * Optimized for protecting API endpoints. This profile is highly sensitive to request patterns (velocity, bursts)
+         * and less reliant on browser-specific behavioral metrics. It's designed to quickly identify and throttle scrapers and automated clients.
+         */
+        'api' => [
+            'summary' => 'API Profile',
+            'description' => 'Optimized for protecting API endpoints. This profile is highly sensitive to request patterns (velocity, bursts) and less reliant on browser-specific behavioral metrics. It\'s designed to quickly identify and throttle scrapers and automated clients.',
+            'weights' => [
+                'historyScore' => 0.5,
+                'rotationScore' => 0.5,
+                'headerAnomalyScore' => 0.3,
+                'requestPatternScore' => 1.0, // Very high weight for API patterns
+                'inconsistencyScore' => 0.7,
+                'behaviorScore' => 0.2, // Lower weight, as browser behavior is not applicable
+                'honeypotScore' => 1.0,
+                'crossLayerInconsistencyScore' => 0.5,
+                'timeInconsistencyScore' => 0.8,
+                'tlsSpoofingScore' => 0.7,
+                'botScore' => 0.5,
+                'cookieDroppingScore' => 0.8, // Important pour les clients API qui doivent maintenir un état
+                'threatIntelScore' => 0.5, // APIs are often targeted by malicious IPs
+                'clientHintsInconsistencyScore' => 0.6, // Relevant signal for APIs
+                'clickVarianceScore' => 0.3, // Low weight as not applicable to APIs
+                'subnetScore' => 0.8, // Très important pour les API pour détecter les botnets
+            ],
+            'thresholds' => ['low' => 25, 'medium' => 50, 'high' => 80, 'block' => 95],
+            'patterns' => [
+                'velocityThreshold' => 200, // APIs are expected to be fast
+                'burstThreshold' => 500,
+                'scrapeThreshold' => 400,
+                'historySize' => 20,
+                'minSamples' => 8,
+                'regularityThreshold' => 20,
+                'benfordThreshold' => 0.18,
+                'patternWeight' => 85,
+                'decayFactor' => 0.9,
+                'inactivityReset' => 10000,
+            ],
+            // This would be a callable in PHP, but for now, we represent its intent.
+            'isApiRequest' => 'req.path.startsWith("/api/") || req.headers.accept?.includes("application/json")',
+        ],
+
+        /**
+         * Blog Profile
+         * Tuned for blogs and content-heavy websites. This profile focuses on detecting content scraping and comment spam
+         * by placing a high weight on request patterns and honeypot traps, while being more lenient on behavioral metrics
+         * typical of readers.
+         */
+        'blog' => [
+            'summary' => 'Blog Profile',
+            'description' => 'Tuned for blogs and content-heavy websites. This profile focuses on detecting content scraping and comment spam by placing a high weight on request patterns and honeypot traps, while being more lenient on behavioral metrics typical of readers.',
+            'weights' => [
+                'historyScore' => 0.2,
+                'rotationScore' => 0.3,
+                'headerAnomalyScore' => 0.1,
+                'requestPatternScore' => 0.8, // High weight to detect content scraping
+                'inconsistencyScore' => 0.7,
+                'behaviorScore' => 0.5, // Less emphasis on complex interactions
+                'honeypotScore' => 1.0, // Crucial for comment spam
+                'crossLayerInconsistencyScore' => 0.4,
+                'timeInconsistencyScore' => 0.8,
+                'tlsSpoofingScore' => 0.6,
+                'botScore' => 0.8,
+                'cookieDroppingScore' => 0.7, // Moins critique, mais toujours un signal
+                'threatIntelScore' => 0.3, // Lower priority for a blog
+                'clientHintsInconsistencyScore' => 0.5,
+                'clickVarianceScore' => 0.5, // Moderate weight for click variance
+                'subnetScore' => 0.4, // Utile contre le spam de commentaires coordonné
+            ],
+            'thresholds' => ['low' => 25, 'medium' => 55, 'high' => 80, 'block' => 95],
+            'patterns' => [
+                'velocityThreshold' => 1000, // Readers can be fast
+                'burstThreshold' => 2000,
+                'scrapeThreshold' => 800, // Very sensitive to scraping patterns
+                'historySize' => 12,
+                'minSamples' => 5,
+                'regularityThreshold' => 60,
+                'benfordThreshold' => 0.16,
+                'patternWeight' => 85,
+                'decayFactor' => 0.92,
+                'inactivityReset' => 10000,
+            ],
+        ],
+
+        /**
+         * E-commerce Profile
+         * A strict profile tailored for e-commerce sites. It's designed to combat inventory scalping,
+         * price scraping, and account takeover attempts by using high weights for request patterns and fingerprint inconsistency.
+         * It also challenges all new devices to increase the cost for bots.
+         */
+        'ecommerce' => [
+            'summary' => 'E-commerce Profile',
+            'description' => 'A strict profile tailored for e-commerce sites. It\'s designed to combat inventory scalping, price scraping, and account takeover attempts by using high weights for request patterns and fingerprint inconsistency. It also challenges all new devices to increase the cost for bots.',
+            'weights' => [
+                'historyScore' => 0.4,
+                'rotationScore' => 0.6,
+                'headerAnomalyScore' => 0.2,
+                'inconsistencyScore' => 1.0, // Crucial for preventing account takeover
+                'behaviorScore' => 0.8, // Important for checkout/login forms
+                'honeypotScore' => 1.0,
+                'crossLayerInconsistencyScore' => 0.7,
+                // NOUVEAU: Ajout des scores manquants pour une configuration complète
+                'requestPatternScore' => 0.9, // Poids unifié pour les patterns, remplace les scores scindés
+                'timeInconsistencyScore' => 0.9,
+                'tlsSpoofingScore' => 0.9,
+                'botScore' => 1.0,
+                'cookieDroppingScore' => 1.0, // Crucial pour la détection de bots e-commerce
+                'threatIntelScore' => 0.8, // Very important for e-commerce (scalping proxies)
+                'clientHintsInconsistencyScore' => 0.9, // Very important for e-commerce
+                'clickVarianceScore' => 0.8, // Very high weight for click variance
+                'subnetScore' => 0.9, // Crucial contre les attaques de scalping distribuées
+            ],
+            'thresholds' => ['low' => 15, 'medium' => 40, 'high' => 70, 'block' => 90],
+            'patterns' => [
+                'velocityThreshold' => 500, // Bots are very fast
+                'burstThreshold' => 1000, // Detects rapid retries on the same product/action
+                'scrapeThreshold' => 600,
+                'historySize' => 15,
+                'minSamples' => 6,
+                'regularityThreshold' => 30,
+                'benfordThreshold' => 0.14,
+                'patternWeight' => 95,
+                'decayFactor' => 0.88,
+                'inactivityReset' => 3000,
+            ],
+            'challengeNewDevices' => true, // New devices are suspicious in e-commerce
+            // This would be a callable in PHP, but for now, we represent its intent.
+            'isApiRequest' => 'req.path.startsWith("/api/cart") || req.path.startsWith("/api/stock") || req.path.startsWith("/api/checkout")',
+        ],
+    ];
+
+    /**
+     * Crée une configuration de sécurité basée sur un profil nommé, avec des surcharges optionnelles.
+     *
+     * @param string $profileName Le nom du profil à utiliser ('balanced', 'strict', 'api', etc.).
+     * @param array<string, mixed> $overrides Un tableau pour fusionner profondément avec le profil, permettant la personnalisation.
+     * @return array<string, mixed> L'objet de configuration de sécurité final.
+     */
+    public static function createSecurityProfile(string $profileName = 'balanced', array $overrides = []): array
+    {
+        $baseProfile = self::PROFILES[$profileName] ?? self::PROFILES['balanced'];
+        return self::deepMerge($baseProfile, $overrides);
+    }
+
+    /**
+     * Fusionne profondément deux tableaux. Les propriétés du tableau `$source` écrasent celles du tableau `$target`.
+     *
+     * @param array<string, mixed> $target Le tableau cible.
+     * @param array<string, mixed> $source Le tableau source.
+     * @return array<string, mixed> Le tableau fusionné.
+     */
+    private static function deepMerge(array $target, array $source): array
+    {
+        $output = $target;
+
+        foreach ($source as $key => $value) {
+            if (is_array($value) && isset($output[$key]) && is_array($output[$key])) {
+                $output[$key] = self::deepMerge($output[$key], $value);
+            } else {
+                $output[$key] = $value;
+            }
+        }
+
+        return $output;
+    }
+}

package/src/php/DirectFingerprint.php

@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint;
+
+/**
+ * Intégration directe du moteur de fingerprinting pour les applications PHP sans framework PSR.
+ * Cette classe interagit directement avec les superglobales PHP et les fonctions de réponse.
+ */
+class DirectFingerprint
+{
+    private FingerprintEngine $engine;
+
+    /**
+     * @param array $securityConfig La configuration de sécurité pour le moteur.
+     */
+    public function __construct(array $securityConfig)
+    {
+        $this->engine = new FingerprintEngine($securityConfig);
+    }
+
+    /**
+     * Protège le point d'entrée actuel.
+     * Analyse la requête entrante et, si nécessaire, envoie une réponse de challenge/blocage et termine le script.
+     * Si la requête est autorisée, la méthode retourne simplement et le reste du script peut s'exécuter.
+     *
+     * @return array{score: float, vector: array}|null Les données du fingerprint si la requête est autorisée, null sinon.
+     */
+    public function protect(): ?array
+    {
+        // 1. Construire le contexte de la requête à partir des superglobales PHP.
+        $body = $_POST ?: json_decode(file_get_contents('php://input'), true);
+        $headers = function_exists('getallheaders') ? getallheaders() : [];
+
+        $context = new RequestContext(
+            $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1',
+            parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '/',
+            $headers,
+            $_GET,
+            $body,
+            $_COOKIE,
+            $_SERVER['SERVER_PROTOCOL'] ?? '1.1'
+        );
+
+        // 2. Traiter la requête avec le moteur.
+        $decision = $this->engine->processRequest($context);
+
+        // 3. Agir sur la décision.
+        if (isset($context->newCookieForResponse)) {
+            $cookie = $context->newCookieForResponse;
+            setcookie($cookie['name'], $cookie['value'], $cookie['options']);
+        }
+
+        switch ($decision['action']) {
+            case 'block':
+            case 'challenge':
+                http_response_code($decision['status'] ?? 403);
+                if (is_array($decision['body'])) {
+                    header('Content-Type: application/json');
+                    echo json_encode($decision['body']);
+                } else {
+                    header('Content-Type: text/html; charset=utf-8');
+                    echo $decision['body'];
+                }
+                exit(); // Termine le script.
+
+            case 'redirect':
+                if (isset($decision['cookie'])) {
+                    setcookie($decision['cookie']['name'], $decision['cookie']['value'], $decision['cookie']['options']);
+                }
+                header('Location: ' . $decision['path'], true, 302);
+                exit(); // Termine le script.
+
+            case 'next':
+            default:
+                // La requête est autorisée, on retourne les informations du fingerprint.
+                return ['score' => $decision['score'], 'vector' => $decision['vector']];
+        }
+    }
+}

package/src/php/FingerprintBuilder.php

@@ -0,0 +1,186 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint;
+
+/**
+ * Classe pour construire une empreinte composite (Multi-Hash).
+ * Format de sortie : "grp1:hash1|grp2:hash2|grp3:hash3"
+ */
+class FingerprintBuilder
+{
+    /**
+     * @var array<string, string|int>
+     */
+    private array $components = [];
+
+    /**
+     * Ajoute un composant à l'empreinte.
+     * La valeur est hachée pour l'anonymiser et réduire sa taille.
+     *
+     * @param string $group Le nom du groupe (ex: 'hw', 'screen', 'geo').
+     * @param string|int|bool|null $value La valeur brute à hacher.
+     * @return self
+     */
+    public function add(string $group, $value): self
+    {
+        if ($value === null || $value === '') {
+            return $this;
+        }
+        // On hache la valeur individuellement.
+        $this->components[$group] = self::cyrb53((string)$value);
+        return $this;
+    }
+
+    /**
+     * Ajoute un composant brut sans le hacher.
+     * Utile pour les métriques qui doivent être lues telles quelles par le serveur.
+     *
+     * @param string $group Le nom du groupe.
+     * @param string|int|null $value La valeur brute.
+     * @return self
+     */
+    public function addRaw(string $group, $value): self
+    {
+        if ($value === null) {
+            return $this;
+        }
+        $this->components[$group] = $value;
+        return $this;
+    }
+
+    /**
+     * Génère la chaîne de l'empreinte finale.
+     * Les composants sont triés par clé pour garantir un ordre déterministe.
+     *
+     * @return string
+     */
+    public function __toString(): string
+    {
+        // ksort trie le tableau par clé.
+        ksort($this->components);
+
+        $parts = [];
+        foreach ($this->components as $key => $hash) {
+            $parts[] = "{$key}:{$hash}";
+        }
+
+        return implode('|', $parts);
+    }
+
+    /**
+     * Compare deux empreintes et retourne un score de similarité (de 0 à 1).
+     * Utilise une pondération pour donner plus d'importance aux invariants forts (Canvas, GPU, JA3).
+     *
+     * @param string|null $fpString1 Empreinte A.
+     * @param string|null $fpString2 Empreinte B.
+     * @return float
+     */
+    public static function compare(?string $fpString1, ?string $fpString2): float
+    {
+        if (empty($fpString1) || empty($fpString2)) {
+            return 0.0;
+        }
+
+        $parse = function (string $str): array {
+            $map = [];
+            foreach (explode('|', $str) as $part) {
+                $pair = explode(':', $part, 2);
+                if (count($pair) === 2 && !empty($pair[0]) && !empty($pair[1])) {
+                    $map[$pair[0]] = $pair[1];
+                }
+            }
+            return $map;
+        };
+
+        $map1 = $parse($fpString1);
+        $map2 = $parse($fpString2);
+
+        $volatileKeys = [
+            'ch_ua', 'ch_platform', 'ch_mobile', 'ch_model', 'ch_arch', 'ch_bitness',
+            'cookie_keys', 'upgrade', 'network', 'http_ver',
+            'x_forwarded_for', 'x_real_ip', 'cf_connecting_ip'
+        ];
+
+        $weights = [
+            'cvs' => 5.0, 'gpu' => 4.0, 'ja3' => 3.5, 'ja4' => 4.0, 'ja4s' => 4.0, 'ja4h' => 3.8,
+            'h2_settings' => 3.0, 'tcp_fp' => 2.5, 'ua' => 2.0,
+            'client_fp_hash' => 3.0, 'browser' => 1.5, 'os_version' => 1.5,
+            'device_type' => 1.0, 'hw' => 1.5, 'scr' => 1.0, 'os' => 0.8, 'geo' => 0.5,
+        ];
+
+        $weightedMatches = 0.0;
+        $totalWeight = 0.0;
+
+        $allKeys = array_unique(array_merge(array_keys($map1), array_keys($map2)));
+
+        foreach ($allKeys as $key) {
+            // On ignore les clés volatiles pour cette comparaison spécifique.
+            if (in_array($key, $volatileKeys, true)) { // @phpstan-ignore-line
+                continue;
+            }
+
+            // On ne compare que les clés qui ont un poids défini.
+            $weight = $weights[$key] ?? null;
+            if ($weight === null) continue;
+
+            $totalWeight += $weight;
+            if (isset($map1[$key]) && isset($map2[$key])) {
+                if ($map1[$key] === $map2[$key]) {
+                    $weightedMatches += $weight;
+                }
+            }
+        }
+
+        return $totalWeight === 0.0 ? 0.0 : $weightedMatches / $totalWeight;
+    }
+
+    /**
+     * Algorithme de hachage cyrb53 (rapide et faible taux de collision).
+     * Porté depuis la version JavaScript.
+     *
+     * @param string $str La chaîne à hacher.
+     * @param int $seed Une graine optionnelle.
+     * @return string Le hash sous forme de chaîne de caractères.
+     */
+    public static function cyrb53(string $str, int $seed = 0): string
+    {
+        $h1 = 0xdeadbeef ^ $seed;
+        $h2 = 0x41c6ce57 ^ $seed;
+
+        for ($i = 0, $l = strlen($str); $i < $l; $i++) {
+            $ch = ord($str[$i]);
+            $h1 = self::imul($h1 ^ $ch, 2654435761);
+            $h2 = self::imul($h2 ^ $ch, 1597334677);
+        }
+
+        $h1 = self::imul($h1 ^ ($h1 >> 16), 2246822507) ^ self::imul($h2 ^ ($h2 >> 13), 3266489909);
+        $h2 = self::imul($h2 ^ ($h2 >> 16), 2246822507) ^ self::imul($h1 ^ ($h1 >> 13), 3266489909);
+
+        // En PHP, les opérations sur les grands nombres peuvent être délicates.
+        // On utilise bcmath pour une arithmétique de précision arbitraire, garantissant le même résultat que JS.
+        $val_h2 = bcadd(bcmul((string)(2097151 & $h2), '4294967296'), (string)($h1 >= 0 ? $h1 : $h1 + 4294967296));
+        return $val_h2;
+    }
+
+    /**
+     * Émule la multiplication 32-bit `Math.imul` de JavaScript.
+     *
+     * @param int $a
+     * @param int $b
+     * @return int Un entier signé 32-bit.
+     */
+    private static function imul(int $a, int $b): int
+    {
+        // Emulation of JavaScript's Math.imul for signed 32-bit integer multiplication.
+        // This version correctly handles overflows on 64-bit systems.
+        $ah = ($a >> 16) & 0xffff;
+        $al = $a & 0xffff;
+        $bh = ($b >> 16) & 0xffff;
+        $bl = $b & 0xffff;
+        $lo = $al * $bl;
+        $hi = (($lo >> 16) + ($al * $bh) + ($ah * $bl)) & 0xffff;
+        return (($hi << 16) | ($lo & 0xffff)) | 0;
+    }
+}

package/src/php/FingerprintClient.php

@@ -0,0 +1,132 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint;
+use Anonympins\Fingerprint\Config\SecurityProfiles;
+
+/**
+ * FingerprintClient - Wrapper PHP pour la bibliothèque de fingerprinting côté client.
+ *
+ * Cette classe facilite l'intégration de la bibliothèque JavaScript `fingerprint.client.js`
+ * dans une application PHP. Elle gère l'injection sécurisée du script et la création
+ * de "honeypots" (pièges à bots) dans les formulaires.
+ */
+class FingerprintClient
+{
+    /**
+     * @var string Le chemin vers le fichier de la bibliothèque client JavaScript.
+     */
+    private string $clientScriptPath;
+
+    /**
+     * @var array La configuration à passer à la fonction `initializeClient` de la bibliothèque JS.
+     */
+    private array $clientConfig;
+
+    /**
+     * @var string|null Un nonce cryptographique pour la Content Security Policy (CSP).
+     */
+    private ?string $nonce;
+
+    /**
+     * Constructeur de la classe.
+     *
+     * @param string $clientScriptPath Le chemin d'accès web au fichier `fingerprint.client.js`.
+     * @param array $clientConfig La configuration pour la bibliothèque client (souris, frappes, honeypots, etc.).
+     */
+    public function __construct(string $clientScriptPath, array $clientConfig = [])
+    {
+        $this->clientScriptPath = $clientScriptPath;
+
+        $defaultConfig = [
+            'mouse' => true,
+            'keystrokes' => true,
+            'clicks' => true,
+            'honeypots' => [],
+            'fetch' => [
+                'handleChallenges' => true,
+                'probationaryTtl' => 30000, // 30 seconds
+            ],
+            'wasm' => true, // Activer la tentative de chargement du module WASM
+            'wasmPath' => '/fp.js' // Chemin vers le script de chargement WASM
+        ];
+
+        // Utiliser une fusion profonde pour permettre de surcharger des sous-clés
+        $this->clientConfig = SecurityProfiles::deepMerge($defaultConfig, $clientConfig);
+
+        try {
+            // Génère un nonce pour CSP si possible, pour une sécurité renforcée.
+            $this->nonce = bin2hex(random_bytes(16));
+        } catch (\Exception $e) {
+            $this->nonce = null;
+        }
+    }
+
+    /**
+     * Génère un champ de formulaire "honeypot" caché.
+     * Les bots le rempliront, mais il sera invisible pour les humains.
+     *
+     * @param string $fieldName Le nom du champ (doit correspondre à la configuration client).
+     * @return string Le code HTML du champ honeypot.
+     */
+    public function generateHoneypotField(string $fieldName): string
+    {
+        // Ajoute le champ à la configuration pour que le script client le surveille.
+        if (!in_array($fieldName, $this->clientConfig['honeypots'])) {
+            $this->clientConfig['honeypots'][] = $fieldName;
+        }
+
+        // Styles CSS pour cacher le champ de manière robuste.
+        $styles = 'position:absolute; left:-9999px; top:-9999px; opacity:0;';
+
+        return '<div style="' . $styles . '" aria-hidden="true">'
+            . '<label for="' . htmlspecialchars($fieldName) . '">Ne pas remplir ce champ</label>'
+            . '<input type="text" id="' . htmlspecialchars($fieldName) . '" name="' . htmlspecialchars($fieldName) . '" tabindex="-1" autocomplete="off">'
+            . '</div>';
+    }
+
+    /**
+     * Génère le bloc de script complet à inclure dans une page HTML.
+     *
+     * @return string Le code HTML des balises <script>.
+     */
+    public function getScriptTag(): string
+    {
+        $configJson = json_encode($this->clientConfig);
+        $nonceAttr = $this->nonce ? ' nonce="' . $this->nonce . '"' : '';
+
+        // Le script d'initialisation qui sera inclus dans la page.
+        $initScript = <<<JS
+document.addEventListener('DOMContentLoaded', function() {
+    const config = {$configJson};
+    if (window.ClientLibrary) {
+        if (config.wasmPath) {
+            const wasmScript = document.createElement('script');
+            wasmScript.src = config.wasmPath;
+            wasmScript.async = true;
+            wasmScript.nonce = '{$this->nonce}';
+            document.head.appendChild(wasmScript);
+        }
+
+        window.ClientLibrary.initializeClient(config);
+    } else {
+        console.error('Fingerprint client library not loaded.');
+    }
+});
+JS;
+
+        // On combine le chargement de la bibliothèque et le script d'initialisation.
+        return '<script src="' . htmlspecialchars($this->clientScriptPath) . '"' . $nonceAttr . '></script>'
+            . '<script' . $nonceAttr . '>' . $initScript . '</script>';
+    }
+
+    /**
+     * Retourne le nonce généré pour pouvoir l'utiliser dans les en-têtes CSP.
+     * @return string|null
+     */
+    public function getNonce(): ?string
+    {
+        return $this->nonce;
+    }
+}