@anonympins/fingerprint 0.3.4 → 0.3.6

package/src/js/fingerprint.js

@@ -346,6 +346,30 @@ function getTlsFingerprint(context) {
     }
     return { ja3, ja4 };
 }
+
+/**
+ * Analyses a raw JA3 string.
+ * Format: "TLSVersion,Ciphers,Extensions,EllipticCurves,EllipticCurveFormats"
+ * @param {string} ja3String
+ * @returns {object|null}
+ */
+export function parseJa3(ja3String) {
+    if (!ja3String || typeof ja3String !== 'string') {
+        return null;
+    }
+    const parts = ja3String.split(',');
+    if (parts.length !== 5) {
+        return null;
+    }
+    return {
+        tlsVersion: parseInt(parts[0], 10),
+        ciphers: parts[1] !== '' ? parts[1].split('-').map(Number) : [],
+        extensions: parts[2] !== '' ? parts[2].split('-').map(Number) : [],
+        curves: parts[3] !== '' ? parts[3].split('-').map(Number) : [],
+        points: parts[4] !== '' ? parts[4].split('-').map(Number) : []
+    };
+}
+
 /**
  * Creates a stable hash based on device characteristics, independent of the IP.
  * This is our "level 2 fingerprint".
@@ -484,6 +508,17 @@ const tlsFingerprintDb = {
     'c72366b9551263d990b7fa574225332c': 'curl',   // curl 7.81.0
 };
 
+const GREASE_VALUES = [
+    2570, 6682, 10794, 14906, 19018, 23130, 27242, 31354,
+    35466, 39578, 43690, 47802, 51914, 55926, 60038, 64150
+];
+
+/** @private */
+function hasGrease(values) {
+    if (!Array.isArray(values)) return false;
+    return values.some(val => GREASE_VALUES.includes(val));
+}
+
 // Fonctions utilitaires
 function parseUserAgent(ua) {
     // Parser basique du User-Agent
@@ -734,6 +769,8 @@ export const verifyPoWAndGenerateTicket = (
   nonce,
   solution,
   difficulty = 4,
+  deviceId = '',
+  deviceHash = ''
 ) => {
   // 1. Verify the solution: hash(ip + nonce + solution) must start with N zeros
   const hash = crypto
@@ -749,10 +786,10 @@ export const verifyPoWAndGenerateTicket = (
   const expiry = Date.now() + 3600000; // 1 heure
   const signature = crypto
     .createHmac("sha256", getPowSecret())
-    .update(`${ip}:${expiry}`)
+    .update(`${expiry}:${ip}:${deviceId}:${deviceHash}`)
     .digest("hex");
 
-  return `${expiry}:${signature}`;
+  return `${expiry}|${ip}|${signature}`;
 };
 
 
@@ -787,23 +824,61 @@ export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret =
   }
   return finalHash === parseInt(solution, 10);
 };
-export const isTicketValid = (ip, ticket) => {
+export const isTicketValid = (ip, ticket, deviceId = '', deviceHash = '') => {
   // Input validation: ensure the ticket is a non-empty string with the correct format.
-  if (typeof ticket !== 'string' || !ticket.includes(':')) return false;
-  const [expiry, sig] = ticket.split(':');
+  if (typeof ticket !== 'string') return false;
+
+  let expiry, originalIp, sig;
+  if (ticket.includes('|')) {
+    const parts = ticket.split('|');
+    if (parts.length < 3) return false;
+    [expiry, originalIp, sig] = parts;
+  } else if (ticket.includes(':')) {
+    // Legacy fallback format
+    const parts = ticket.split(':');
+    if (parts.length < 2) return false;
+    [expiry, sig] = parts;
+    originalIp = ip;
+  } else {
+    return false;
+  }
+
   if (!expiry || !sig || Date.now() > parseInt(expiry, 10)) return false;
-  const expectedSig = crypto
-    .createHmac("sha256", getPowSecret())
-    .update(`${ip}:${expiry}`)
-    .digest("hex");
+
+  let expectedSig;
+  if (ticket.includes('|')) {
+    expectedSig = crypto
+      .createHmac("sha256", getPowSecret())
+      .update(`${expiry}:${originalIp}:${deviceId}:${deviceHash}`)
+      .digest("hex");
+  } else {
+    // Legacy expected signature
+    expectedSig = crypto
+      .createHmac("sha256", getPowSecret())
+      .update(`${ip}:${expiry}`)
+      .digest("hex");
+  }
 
   // Use timingSafeEqual to prevent timing attacks
   try {
-    return crypto.timingSafeEqual(Buffer.from(sig, 'hex'), Buffer.from(expectedSig, 'hex'));
+    const isSigValid = crypto.timingSafeEqual(Buffer.from(sig, 'hex'), Buffer.from(expectedSig, 'hex'));
+    if (!isSigValid) return false;
   } catch (e) {
-    // This can happen if the buffers have different lengths, which is a failure case.
     return false;
   }
+
+  if (!ticket.includes('|')) {
+    return ip === originalIp;
+  }
+
+  // Roaming & Terminal Identity checks:
+  if (ip === originalIp) return true;
+  const currentSubnet = getIpSubnet(ip);
+  const originalSubnet = getIpSubnet(originalIp);
+  if (currentSubnet && originalSubnet && currentSubnet === originalSubnet) return true;
+
+  // Perfect terminal identity matched via HMAC signature
+  return !!(deviceId && deviceHash);
 };
 
 
@@ -814,8 +889,9 @@ export const isTicketValid = (ip, ticket) => {
  */
 function getHeaderAnomalies(context) {
   let anomalyScore = 0;
+  const ua = context.headers["user-agent"] || '';
   // Strong penalty if User-Agent is missing or very short (sign of a simple script)
-  if (!context.headers["user-agent"] || context.headers["user-agent"].length < 10) {
+  if (!ua || ua.length < 10) {
     anomalyScore += 60;
   }
   // Penalty if Accept-Language header is missing
@@ -827,6 +903,17 @@ function getHeaderAnomalies(context) {
     anomalyScore += 15;
   }
 
+  // TE: trailers check for Firefox on Desktop
+  const uaParts = parseUserAgent(ua);
+  const isFirefoxDesktop = uaParts.browser?.startsWith('Firefox') && uaParts.device === 'desktop';
+  const teHeader = context.headers['te'];
+
+  if (isFirefoxDesktop && teHeader !== 'trailers') {
+    anomalyScore += 30; // Suspicious: Firefox desktop missing TE: trailers
+  } else if (!isFirefoxDesktop && uaParts.device === 'desktop' && teHeader === 'trailers') {
+    anomalyScore += 30; // Suspicious: Non-Firefox desktop sending TE: trailers
+  }
+
   return {
     headerAnomalyScore: Math.min(100, anomalyScore),
   };
@@ -1142,21 +1229,130 @@ function getCrossLayerInconsistency(context) {
         return { crossLayerInconsistencyScore: 10 }; // Erreur de parsing = suspect.
     }
 }
+function parseJa4(ja4) {
+    if (!ja4 || typeof ja4 !== 'string') return null;
+    const parts = ja4.split('_');
+    const ja4a = parts[0];
+    if (ja4a.length < 10) return null;
+    return {
+        protocol: ja4a[0],
+        version: ja4a.substring(1, 3),
+        sni: ja4a[3],
+        ciphersCount: parseInt(ja4a.substring(4, 6), 10) || 0,
+        extensionsCount: parseInt(ja4a.substring(6, 8), 10) || 0,
+        alpn: ja4a.substring(8, 10),
+        ja4b: parts[1] || null,
+        ja4c: parts[2] || null
+    };
+}
 
 /**
  * Calcule un score d'incohérence entre les données du fingerprint TLS (JA3/JA4) et les en-têtes serveur (User-Agent).
  * Cela permet de détecter le spoofing de fingerprint TLS.
  * @param {object} context - Le contexte de la requête.
- * @returns {{tlsSpoofingScore: number}}
+ * @returns {Promise<{tlsSpoofingScore: number}>}
  */
-function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerprint) {
-    const { ja3, ja4 } = getTlsFingerprintFn(context) || { ja3: null, ja4: null }; // Defensive check
+export function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerprint, customStore = null) {
+    let actualGetTlsFingerprintFn = getTlsFingerprintFn;
+    let actualStore = customStore || store;
+
+    // Detect if the second argument is actually a store (compatibility with tests)
+    if (getTlsFingerprintFn && typeof getTlsFingerprintFn.get === 'function' && typeof getTlsFingerprintFn.set === 'function') {
+        actualStore = getTlsFingerprintFn;
+        actualGetTlsFingerprintFn = getTlsFingerprint;
+    }
+
+    const { ja3, ja4 } = actualGetTlsFingerprintFn(context) || { ja3: null, ja4: null }; // Defensive check
     const ua = context.headers["user-agent"] || '';
+    const ja3Raw = context.headers['x-ja3-raw'] || null;
+    const httpVersion = context.httpVersion || '';
+
+    let score = 0;
 
     // 1. Penalize if a TLS fingerprint is present but the User-Agent is generic or missing.
     // This is a strong indicator of a non-browser client trying to look legitimate.
     if ((ja3 || ja4) && (!ua || ua.length < 10 || ua.toLowerCase().includes('python') || ua.toLowerCase().includes('curl'))) {
-        return { tlsSpoofingScore: 50 };
+        score = Math.max(score, 50);
+    }
+
+    // Check for known spoofed/suspicious JA4 fingerprints
+    const spoofedJa4s = [
+        't13d1516h2_8daaf6152771_390237aa04be', // Chrome classique (curl-impersonate / tls-client)
+        't13d1413h2_bc66258908f0_bc2531da1615', // Firefox statique (curl-impersonate-ff / curl_cffi)
+        't13d1515h2_8daaf6152771_a729e2f67de4', // Safari statique (curl-impersonate-safari / tls-client)
+        't13d1516h2_8daaf6152771_4be0df930c2c', // Alternatif Chrome (tls-client Go)
+        't12d1516h2_8daaf6152771_390237aa04be', // Chrome usurpé dégradé en TLS 1.2
+        't13d1516h2_e822d36d892d_93ec3f0b2f5b'  // Scraping bot OpenSSL customisé
+    ];
+    if (ja4 && spoofedJa4s.includes(ja4)) {
+        score = Math.max(score, 100);
+    }
+
+    const claimedBrowser = parseUserAgent(ua).browser?.split('/')[0] || null;
+    const isHumanBrowser = ['Chrome', 'Firefox', 'Safari', 'Edge'].includes(claimedBrowser);
+
+    // --- ANALYSE 2 : CONTRÔLE PROFOND SUR L'EMPREINTE BRUTE (RAW JA3) ---
+    if (ja3Raw) {
+        const parsed = parseJa3(ja3Raw);
+        if (parsed) {
+            // Contrôle A : Mécanisme GREASE pour Chrome / Edge (obligatoire)
+            if (claimedBrowser === 'Chrome' || claimedBrowser === 'Edge') {
+                const hasCiphersGrease = hasGrease(parsed.ciphers);
+                const hasExtensionsGrease = hasGrease(parsed.extensions);
+                
+                if (!hasCiphersGrease && !hasExtensionsGrease) {
+                    // Chrome ou Edge moderne sans GREASE = spoofing de bas niveau (ex: python-requests déguisé)
+                    score = Math.max(score, 75);
+                }
+            }
+
+            // Contrôle B : HTTP/2 ou HTTP/3 sans négociation ALPN (Extension 16)
+            const isH2OrHigher = (
+                httpVersion.includes('2.0') || 
+                httpVersion.includes('HTTP/2') || 
+                httpVersion.includes('HTTP/3')
+            );
+            const hasAlpnExtension = parsed.extensions.includes(16);
+            
+            if (isH2OrHigher && !hasAlpnExtension) {
+                // Négociation HTTP/2 active au niveau serveur mais absente au niveau des extensions TLS du client
+                score = Math.max(score, 70);
+            }
+
+            // Contrôle C : Version TLS obsolète négociée par un navigateur moderne (ex: TLS < 1.2, id < 771)
+            if (isHumanBrowser && parsed.tlsVersion < 771) {
+                score = Math.max(score, 80);
+            }
+        }
+    }
+
+    // Parse JA4 if available for advanced checks
+    if (ja4) {
+        const parsedJa4 = parseJa4(ja4);
+        if (parsedJa4) {
+            const uaParts = parseUserAgent(ua);
+
+            // Check 1: Incohérence ALPN / HTTP Version
+            if (parsedJa4.alpn === 'h2' && (context.httpVersion === '1.1' || context.httpVersion === '1.0')) {
+                const hasProxy = context.headers['via'] || context.headers['forwarded'] || context.headers['x-forwarded-proto'] || context.headers['x-forwarded-for'];
+                if (!hasProxy) {
+                    score = Math.max(score, 40);
+                }
+            }
+
+            // Check 2: Incohérence OS/Plateforme vs Capabilities TLS
+            if (parsedJa4.version === '12' && (uaParts.os === 'iOS' || uaParts.os === 'macOS') && uaParts.browser?.startsWith('Safari')) {
+                score = Math.max(score, 60);
+            }
+
+            // Check 3: Incohérence User-Agent vs Signature JA4
+            if (uaParts.browser?.startsWith('Chrome') && parsedJa4.alpn === '00') {
+                score = Math.max(score, 50);
+            }
+            if (uaParts.browser?.startsWith('Firefox') && parsedJa4.extensionsCount > 15) {
+                score = Math.max(score, 50);
+            }
+        }
     }
 
     // 2. If no JA3 hash is available, we cannot perform the consistency check.
@@ -1173,23 +1369,72 @@ function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerprint) {
             // Parse the User-Agent to get the claimed browser.
             const { browser: claimedBrowser } = parseUserAgent(ua);
 
-            // Check if the claimed browser is one of the legitimate possibilities for this JA3 hash.
-            // We use `some` to see if the claimed browser starts with any of the expected browser names.
-            // (e.g., "Chrome/116" starts with "Chrome").
-            const isMatch = expectedBrowsers.some(expected => claimedBrowser?.startsWith(expected));
-
-            if (claimedBrowser && !isMatch) {
-                return { tlsSpoofingScore: 80 }; // High score for a clear mismatch.
+            // Check 1: Known library JA3 with a human-claimed browser
+            const isLibrary = expectedBrowsers.some(expected => ['Python', 'Go', 'Java', 'curl'].includes(expected));
+            const claimsToBeHumanBrowser = claimedBrowser && (
+                claimedBrowser.startsWith('Chrome') || 
+                claimedBrowser.startsWith('Firefox') || 
+                claimedBrowser.startsWith('Safari') || 
+                claimedBrowser.startsWith('Edge')
+            );
+            
+            if (isLibrary && claimsToBeHumanBrowser) {
+                score = Math.max(score, 90); // High confidence spoofing of library as browser
+            } else {
+                // Check if the claimed browser is one of the legitimate possibilities for this JA3 hash.
+                const isMatch = expectedBrowsers.some(expected => claimedBrowser?.startsWith(expected));
+                if (claimedBrowser && !isMatch) {
+                    score = Math.max(score, 80); // High score for a clear mismatch.
+                }
             }
         }
     }
 
-    // If we reach here, either:
-    // - No JA3 was available.
-    // - The JA3 was not in our database (we can't make a decision).
-    // - The JA3 and User-Agent were consistent.
-    // In all these cases, the score is 0.
-    return { tlsSpoofingScore: 0 };
+    // Create the promise for the async part (Check 4)
+    const promise = (async () => {
+        let asyncScore = score;
+        const uaParts = parseUserAgent(ua);
+        
+        if (uaParts.browser) {
+            const browserFamily = uaParts.browser.split('/')[0];
+            
+            // Check 4a: Stagnation JA4
+            if (ja4) {
+                const parsedJa4 = parseJa4(ja4);
+                if (parsedJa4) {
+                    const ja4Key = `ja4-browsers:${ja4}`;
+                    let seenBrowsers = await actualStore.get(ja4Key) || [];
+                    if (!Array.isArray(seenBrowsers)) seenBrowsers = [];
+                    if (browserFamily && !seenBrowsers.includes(browserFamily)) {
+                        seenBrowsers.push(browserFamily);
+                    await actualStore.set(ja4Key, seenBrowsers, 86400); // 24h cache
+                    }
+                    if (seenBrowsers.length > 1) {
+                        asyncScore = Math.max(asyncScore, 80);
+                    }
+                }
+            }
+            
+            // Check 4b: JA3 MD5 stagnation with rotating browser UAs
+            if (ja3 && browserFamily) {
+                const ja3Key = `ja3-browsers:${ja3}`;
+                let seenBrowsers = await actualStore.get(ja3Key) || [];
+                if (!Array.isArray(seenBrowsers)) seenBrowsers = [];
+                if (!seenBrowsers.includes(browserFamily)) {
+                    seenBrowsers.push(browserFamily);
+                    await actualStore.set(ja3Key, seenBrowsers, 86400); // 24h cache
+                }
+                if (seenBrowsers.length > 1) {
+                    asyncScore = Math.max(asyncScore, 85); // Staging different UAs on same JA3 MD5 signature
+                }
+            }
+        }
+        return { tlsSpoofingScore: asyncScore };
+    })();
+
+    // Decorate the promise so synchronous calls can destructure it!
+    promise.tlsSpoofingScore = score;
+    return promise;
 }
 
 /**
@@ -1501,7 +1746,7 @@ function getBotScore(context) {
         }
     } catch (e) { /* Ignorer les erreurs de parsing */ }
 
-    return { botScore: 0 };
+        return { botScore: 0 };
 }
 
 /**
@@ -1573,6 +1818,22 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
         }
     }
 
+    // Détection d'énumération de chemins (crawling/scraping de ressources séquentielles)
+    let enumerationScore = 0;
+    if (history.length >= 3) {
+        const templates = history.map(h => h.path.replace(/\d+/g, '{num}'));
+        const uniquePaths = new Set(history.map(h => h.path));
+
+        const templateCounts = {};
+        templates.forEach(t => templateCounts[t] = (templateCounts[t] || 0) + 1);
+
+        const maxTemplateRepetition = Math.max(...Object.values(templateCounts), 0);
+        // Si une même structure de route est répétée mais sur des URLs réelles différentes
+        if (maxTemplateRepetition >= 3 && uniquePaths.size === history.length) {
+            enumerationScore = patternWeight * 0.8; // Appliquer une forte pénalité
+        }
+    }
+
     // Garder l'historique à une taille raisonnable
     if (history.length > historySize) {
         history.shift();
@@ -1591,7 +1852,7 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
     }
     newPatternScore = Math.max(0, newPatternScore);
 
-    deviceData.lastPatternScore = newPatternScore + instantScore;
+    deviceData.lastPatternScore = newPatternScore + instantScore + enumerationScore;
 
     return { requestPatternScore: Math.min(100, deviceData.lastPatternScore) };
 }
@@ -1854,7 +2115,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
   // On appelle getHoneypotScore ici pour que son résultat soit inclus dans le vecteur.
   const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
 
-  const { tlsSpoofingScore } = getTlsSpoofingScore(context);
+  const { tlsSpoofingScore } = await getTlsSpoofingScore(context);
 
   const { botScore } = getBotScore(context);
 
@@ -2136,6 +2397,8 @@ export function verifyCpuTargetPoWAndGenerateTicket(
   nonce,
   solution,
   challengeContext = {}, // Le contexte complet du challenge est maintenant passé
+  deviceId = '',
+  deviceHash = ''
 ) {
   const { cpuTarget, baseBlock } = challengeContext;
   if (!cpuTarget || !baseBlock) {
@@ -2187,9 +2450,9 @@ export function verifyCpuTargetPoWAndGenerateTicket(
       const expiry = Date.now() + (ticketTtl || 3600000); // Calcule l'expiration à partir du TTL
       const signature = crypto
       .createHmac("sha256", getPowSecret())
-      .update(`${clientIp}:${expiry}`)
+      .update(`${expiry}:${clientIp}:${deviceId}:${deviceHash}`)
       .digest("hex");
-    return `${expiry}:${signature}`;
+    return `${expiry}|${clientIp}|${signature}`;
   }
 
   return null;
@@ -2269,7 +2532,7 @@ export class FingerprintEngine {
       console.log(`[FingerprintEngine] ${message}`, data);
     }
   }
-    calculateFinalScore = function(suspicionVector) {
+    calculateFinalScore(suspicionVector) {
         const { weights } = this.securityConfig;
         if (!weights) return 0;
 
@@ -2523,8 +2786,15 @@ export class FingerprintEngine {
       }
 
       // 2. Forward DNS lookup
-      const addresses = await dns.resolve(validHostname);
-      if (addresses.includes(clientIp)) {
+    let addresses = [];
+    try {
+      addresses = await dns.resolve(validHostname);
+    } catch (e) {}
+    try {
+      const ipv6 = await dns.resolve(validHostname, 'AAAA');
+      addresses = addresses.concat(ipv6);
+    } catch (e) {}
+    if (addresses.includes(clientIp)) {
         await store.set(cacheKey, 'verified', 86400); // Cache success for 24h (TTL in seconds)
         return true;
       }
@@ -2548,6 +2818,11 @@ export class FingerprintEngine {
       return { action: 'next', score: 0, vector: {} };
     }
 
+    // Resolve identity and check for persisted "condemned" status early.
+    const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
+    const currentDeviceHash = getCompositeDeviceHash(requestContext);
+    const isNewDevice = !!newCookie;
+
     // 1. Check static IP allowlist first for maximum performance.
     if (this._isIpInAllowlist(clientIp)) {
       this._log('IP in allowlist - allowing request', { clientIp });
@@ -2586,7 +2861,7 @@ export class FingerprintEngine {
     // If we see a pow_nonce on a request that isn't (yet) considered suspicious, it's a bot probe.
     if (pow_nonce) {
         const powCookie = cookies?.pow_clearance;
-        if (!isTicketValid(clientIp, powCookie)) { // Only check if there's no valid ticket
+        if (!isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash)) { // Only check if there's no valid ticket
             // This is a potential probe. We'll let the main logic confirm if it's not a legitimate challenge response.
             // The final decision is made later, after calculating the score.
         }
@@ -2598,10 +2873,6 @@ export class FingerprintEngine {
       return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'bot' } };
     }
     
-    // Resolve identity and check for persisted "condemned" status early.
-    const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
-    const isNewDevice = !!newCookie;
-    
     this._log('Identity resolved', { deviceId, isNewDevice, hasDeviceData: !!deviceData });
 
     if (deviceData?.condemned) {
@@ -2696,7 +2967,26 @@ export class FingerprintEngine {
         });
 
         let isValid = false;
-        const challengeContext = await store.get(`secret:${pow_nonce}`);
+            let challengeContext = await store.get(`secret:${pow_nonce}`);
+
+            // SECURITY: Verify that the retrieved context has not been tampered with
+            if (challengeContext && challengeContext.signature) {
+                const payloadToSign = `${challengeContext.clientSecret}:${challengeContext.cpuTarget}:${challengeContext.fingerprint}:${challengeContext.memDifficulty}:${challengeContext.originalPath}:${clientIp}`;
+                const expectedSignature = crypto.createHmac("sha256", getPowSecret()).update(payloadToSign).digest("hex");
+                try {
+                    const isSignatureValid = crypto.timingSafeEqual(
+                        Buffer.from(challengeContext.signature, 'hex'),
+                        Buffer.from(expectedSignature, 'hex')
+                    );
+                    if (!isSignatureValid) {
+                        this._log('Challenge context signature invalid - storage tampering detected!', { nonce: pow_nonce });
+                        challengeContext = null; // Invalidate context immediately
+                    }
+                } catch (e) {
+                    this._log('Error validating challenge context signature:', e);
+                    challengeContext = null;
+                }
+            }
         let ticket = null;
         // Déclarer optimalTtl ici avec une valeur par défaut
         let optimalTtl = this.securityConfig.ticketMaxAge || 3600000;
@@ -2745,11 +3035,12 @@ export class FingerprintEngine {
 
                 if ((pow_type === "cpu_target" || !pow_type) && (pow_solution_cpu || pow_solution)) { // !pow_type pour compatibilité
                     const cpuSolution = pow_solution_cpu || pow_solution;
-            ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext);
+                    ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext, deviceId, currentDeviceHash);
                     isValid = ticket !== null;
                     this._log('CPU target challenge verification', { isValid });
-                } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext);
-            const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
+                } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
+                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext, deviceId, currentDeviceHash);
+                    const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
                     isValid = cpuTicket !== null && isMemValid;
                     if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
                     this._log('Combined CPU+Memory challenge verification', {
@@ -2875,7 +3166,10 @@ export class FingerprintEngine {
         if (challengeContext) {
             try {
                 const workResult = JSON.parse(pow_solution_work_result);
-                getProblemManager(this.securityConfig.usefulWorkConfigPath).integrateSolution(pow_problem_id, workResult);
+                getProblemManager({
+                    configPath: this.securityConfig.usefulWorkConfigPath,
+                    config: this.securityConfig.usefulWorkConfig
+                }, store).integrateSolution(pow_problem_id, workResult);
 
                 await store.delete(`secret:${pow_nonce}`);
                 // Accorder un ticket de passage comme pour un PoW normal
@@ -2941,7 +3235,7 @@ export class FingerprintEngine {
     // 1. La requête est suspecte ET il n'y a pas de ticket valide.
     // OU
     // 2. La requête est *très* suspecte (dépasse le seuil 'high'), ce qui annule la validité du ticket actuel.
-    const hasValidTicket = isTicketValid(clientIp, powCookie);
+    const hasValidTicket = isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash);
     const mustReChallenge = isSuspiciousHigh && hasValidTicket;
 
     if (isSuspicious && (!hasValidTicket || mustReChallenge)) {
@@ -2985,7 +3279,10 @@ export class FingerprintEngine {
         if (isSuspicious && shouldUseUsefulWork) {
             this._log('Issuing a useful work challenge', { finalScore });
 
-            const { problemId, task } = getProblemManager(this.securityConfig.usefulWorkConfigPath).dispatchWork(suspicionFactor);
+            const { problemId, task } = getProblemManager({
+                configPath: this.securityConfig.usefulWorkConfigPath,
+                config: this.securityConfig.usefulWorkConfig
+            }, store).dispatchWork(suspicionFactor);
 
             await store.set(`secret:${nonce}`, { clientSecret, originalPath: path }, 300);
 
@@ -3033,6 +3330,11 @@ export class FingerprintEngine {
 
             // Store the entire challenge context with a short TTL (e.g., 5 minutes)
             const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, originalFingerprint);
+
+            // SECURITY: Cryptographically sign the payload before storing it to prevent database tampering
+            const payloadToSign = `${clientSecret}:${cpuChallengeDetails.target}:${originalFingerprint}:${memDifficulty}:${path}:${clientIp}`;
+            const signature = crypto.createHmac("sha256", getPowSecret()).update(payloadToSign).digest("hex");
+
             await store.set(`secret:${nonce}`, {
                 clientSecret,
                 cpuTarget: cpuChallengeDetails.target,
@@ -3041,6 +3343,7 @@ export class FingerprintEngine {
                 memDifficulty: memDifficulty,
                 baseBlock: baseBlock, // *** NOUVEAU: Le bloc de base est stocké pour la vérification ***
                 originalPath: path, // *** FIX: Store the original path ***
+                signature, // *** NOUVEAU: Cryptographic signature to prevent storage tampering ***
             }, this.securityConfig.challengeTtl || 300); // NOUVEAU: TTL configurable (5min par défaut)
 
             // Associate the current challenge nonce with the device for trap URL verification later.
@@ -3090,7 +3393,7 @@ export class FingerprintEngine {
     }
 
     // Basic log for each non-static request that passed without a challenge
-    this._log('Request passed - no challenge required', { finalScore, hasValidTicket: isTicketValid(clientIp, powCookie) });
+    this._log('Request passed - no challenge required', { finalScore, hasValidTicket: isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash) });
     
     if (logger) {
         logger({ type: 'request_passed', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
@@ -3539,7 +3842,9 @@ export const __internal = {
     getTimeInconsistencyScore,
     getClickVarianceScore, // NOUVEAU: Expose pour les tests
     getTlsFingerprint, // NOUVEAU: Expose pour les tests
+    sanitizeTrafficData, // NOUVEAU: Expose pour l'auto-tuner/tests
     getTlsSpoofingScore, // NOUVEAU: Expose pour les tests
+    parseJa3,
     generateCpuTargetChallengePage,
     getClientHintsInconsistencyScore, // Expose for testing
     generateCombinedPoWChallengePage,
@@ -3556,25 +3861,60 @@ export const __internal = {
 let autoTuningJobId = null;
 let lastBestSolution = null; // NOUVEAU: Stocke la meilleure solution trouvée
 
+/**
+ * Assainit les données de trafic pour l'auto-tuner afin de prévenir les attaques par empoisonnement.
+ * Limite la contribution de chaque deviceId à un pourcentage maximum (ex: 2%) du jeu de données total.
+ * @export
+ * @param {Array<object>} trafficData
+ * @returns {Array<object>}
+ */
+export function sanitizeTrafficData(trafficData) {
+  if (!trafficData || trafficData.length === 0) {
+    return [];
+  }
+  const tempSanitized = [];
+  const deviceCounts = new Map();
+  const maxLogsPerDevice = Math.max(3, Math.floor(trafficData.length * 0.02)); // Max 2% contribution per device
+
+  for (const log of trafficData) {
+    const devId = log.deviceId || 'anonymous';
+    const currentCount = deviceCounts.get(devId) || 0;
+    if (currentCount < maxLogsPerDevice) {
+      deviceCounts.set(devId, currentCount + 1);
+      tempSanitized.push(log);
+    }
+  }
+
+  const passedLogs = tempSanitized.filter(log => log.type === 'request_passed');
+  const suspiciousLogs = tempSanitized.filter(log => log.type !== 'request_passed');
+
+  const minDataPoints = 200; // Seuil par défaut
+  const maxPassedAllowed = Math.max(minDataPoints, suspiciousLogs.length * 9);
+  const shuffledPassed = passedLogs.sort(() => 0.5 - Math.random());
+  const selectedPassed = shuffledPassed.slice(0, maxPassedAllowed);
+
+  return [...suspiciousLogs, ...selectedPassed];
+}
+
 /**
  * Executes a threshold optimization pass using collected traffic data.
  * @private
- * @param {object} securityConfig - The security configuration object to update.
- * @param {Array<object>} trafficData - The array containing traffic logs.
- * @param {number} minDataPoints - The minimum number of data points required to start optimization.
- * @param {number} maxDataPoints - The maximum number of data points to keep after an optimization cycle.
- * @param {string} [savePath] - Optional path to save the best configuration to a file.
  */
 function runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints, savePath) {
-  const highConfidenceLogs = trafficData.filter(log => log.type === 'challenge_solved' || log.type === 'trap_triggered').length;
-  const highConfidenceRatio = trafficData.length > 0 ? highConfidenceLogs / trafficData.length : 0;
+  const sanitizedData = sanitizeTrafficData(trafficData);
+
+  const highConfidenceLogs = sanitizedData.filter(log => log.type === 'challenge_solved' || log.type === 'trap_triggered').length;
+  const highConfidenceRatio = sanitizedData.length > 0 ? highConfidenceLogs / sanitizedData.length : 0;
   const MIN_CONFIDENCE_RATIO = 0.05; // Exiger au moins 5% de signaux forts.
+  const MIN_HIGH_CONFIDENCE_COUNT = 10; // Absolu de secours pour éviter le gel lors de floods
+
+  const hasEnoughSignal = highConfidenceRatio >= MIN_CONFIDENCE_RATIO || highConfidenceLogs >= MIN_HIGH_CONFIDENCE_COUNT;
 
-  if (trafficData.length < minDataPoints || highConfidenceRatio < MIN_CONFIDENCE_RATIO) {
-    if (trafficData.length < minDataPoints) {
-    console.log(`[AutoTuning] Reporté : ${trafficData.length}/${minDataPoints} points de données.`);
+  if (sanitizedData.length < minDataPoints || !hasEnoughSignal) {
+    if (sanitizedData.length < minDataPoints) {
+    console.log(`[AutoTuning] Reporté : ${sanitizedData.length}/${minDataPoints} points de données.`);
     } else {
-      console.log(`[AutoTuning] Reporté : Ratio de confiance insuffisant (${(highConfidenceRatio * 100).toFixed(2)}% < ${(MIN_CONFIDENCE_RATIO * 100).toFixed(2)}%).`);
+      console.log(`[AutoTuning] Reporté : Signaux de confiance insuffisants (Ratio: ${(highConfidenceRatio * 100).toFixed(2)}% < ${(MIN_CONFIDENCE_RATIO * 100).toFixed(2)}% et absolu: ${highConfidenceLogs} < ${MIN_HIGH_CONFIDENCE_COUNT}).`);
     }
     return;
   }
@@ -3584,9 +3924,9 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
     trafficData.splice(0, trafficData.length - maxDataPoints);
   }
 
-  console.log(`[AutoTuning] Démarrage du cycle d'optimisation complet avec ${trafficData.length} points de données.`);
+  console.log(`[AutoTuning] Démarrage du cycle d'optimisation complet avec ${sanitizedData.length} points de données assainis.`);
 
-  const paretoFront = Optimization.Operators.solveFullSecurityTuning({ trafficData });
+  const paretoFront = Optimization.Operators.solveFullSecurityTuning({ trafficData: sanitizedData });
 
   if (!paretoFront || paretoFront.length === 0) {
     console.warn("[AutoTuning] L'optimisation n'a retourné aucune solution.");