@anonympins/fingerprint 0.3.6 → 0.3.8

package/src/js/fingerprint.js

@@ -1,12 +1,13 @@
 import crypto from "node:crypto";
-import { BlockList, isIPv4, isIPv6 } from "node:net";
+import {BlockList, isIPv4, isIPv6} from "node:net";
 import * as dns from "node:dns/promises";
-import { getProblemManager, problemManager } from "./problem-manager.js";
-import { Optimization } from "./library.js";
-import { cyrb53, FingerprintBuilder } from "./fingerprint.builder.js";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
+import {getProblemManager, problemManager} from "./problem-manager.js";
+import {Optimization} from "./library.js";
+import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
+import {readFileSync} from "node:fs";
+import {fileURLToPath} from "node:url";
+import {dirname, join} from "node:path";
+
 export { createRedisStore } from "./redis-store.js";
 export { createMongoDbStore } from "./mongodb-store.js";
 
@@ -49,6 +50,7 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.4,
             timeInconsistencyScore: 0.9,
             tlsSpoofingScore: 0.8, // NOUVEAU: Poids pour la détection de spoofing TLS
+            subnetScore: 0.4, // NOUVEAU: Poids pour la réputation du sous-réseau
             ipReputationScore: 0.5 // NOUVEAU: Poids pour la réputation IP
         },
         thresholds: { low: 20, medium: 45, high: 75, block: 95 },
@@ -64,6 +66,7 @@ const securityProfiles = {
             decayFactor: 0.9,
             inactivityReset: 5000,
         },
+        allowCrossNetworkRoaming: true, // Profil balancé : tolérant par défaut
     },
     /**
      * @summary **Strict Profile**
@@ -81,6 +84,7 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.6,
             timeInconsistencyScore: 1.0,
             tlsSpoofingScore: 1.0, // Plus agressif pour le spoofing TLS
+            subnetScore: 0.5,
             ipReputationScore: 0.6 // NOUVEAU: Poids pour la réputation IP
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
@@ -97,6 +101,7 @@ const securityProfiles = {
             inactivityReset: 4000,
         },
         challengeNewDevices: true, // Challenge all new devices
+        allowCrossNetworkRoaming: false, // Strict : interdiction de changer complètement de réseau sans re-challenge
     },
     /**
      * @summary **API Profile**
@@ -114,6 +119,7 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.5,
             timeInconsistencyScore: 0.8,
             tlsSpoofingScore: 0.7, // Important pour les API
+            subnetScore: 0.4,
             ipReputationScore: 0.5 // NOUVEAU: Poids pour la réputation IP
         },
         thresholds: { low: 25, medium: 50, high: 80, block: 95 },
@@ -130,6 +136,7 @@ const securityProfiles = {
             inactivityReset: 10000,
         },
         isApiRequest: (req) => req.path.startsWith('/api/') || req.headers.accept?.includes('application/json'),
+        allowCrossNetworkRoaming: false, // Les API ne doivent pas subir de roaming inter-IP suspect
     }
     ,
     /**
@@ -148,6 +155,7 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.4,
             timeInconsistencyScore: 0.8,
             tlsSpoofingScore: 0.6, // Moins critique pour les blogs
+            subnetScore: 0.2,
             ipReputationScore: 0.3 // NOUVEAU: Poids pour la réputation IP
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
@@ -163,6 +171,7 @@ const securityProfiles = {
             decayFactor: 0.92,
             inactivityReset: 10000,
         },
+        allowCrossNetworkRoaming: true,
     },
     /**
      * @summary **E-commerce Profile**
@@ -181,6 +190,7 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.7,
             timeInconsistencyScore: 0.9,
             tlsSpoofingScore: 0.9, // Très important pour l'e-commerce
+            subnetScore: 0.5,
             ipReputationScore: 0.6 // NOUVEAU: Poids pour la réputation IP
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
@@ -198,6 +208,7 @@ const securityProfiles = {
         },
         challengeNewDevices: true, // New devices are suspicious in e-commerce
         isApiRequest: (req) => req.path.startsWith('/api/cart') || req.path.startsWith('/api/stock') || req.path.startsWith('/api/checkout'),
+        allowCrossNetworkRoaming: false, // E-commerce : interdiction de changer de réseau sans re-challenge
     }
 };
 
@@ -764,7 +775,7 @@ const generateMemoryPoWChallenge = (
 /**
  * Verifies if a PoW solution is valid and generates a clearance ticket.
  */
-export const verifyPoWAndGenerateTicket = (
+export const verifyPoWAndGenerateTicket = async (
   ip,
   nonce,
   solution,
@@ -782,30 +793,51 @@ export const verifyPoWAndGenerateTicket = (
     return null;
   }
 
-  // 2. Generate an HMAC ticket so the client doesn't have to do it again for 1 hour
-  const expiry = Date.now() + 3600000; // 1 heure
-  const signature = crypto
-    .createHmac("sha256", getPowSecret())
-    .update(`${expiry}:${ip}:${deviceId}:${deviceHash}`)
-    .digest("hex");
+  // 2. Generate an opaque ticket ID and store session metadata securely on the server
+  const ticketId = crypto.randomUUID();
+  const expiry = Date.now() + 3600000; // 1 hour
 
-  return `${expiry}|${ip}|${signature}`;
+  await store.set(`ticket:${ticketId}`, {
+    expiry,
+    originalIp: ip,
+    deviceId,
+    deviceHash
+  }, 3600); // 1 hour TTL
+
+  return ticketId;
 };
 
 
 
 /**
  * Verifies a memory PoW solution.
- * The server performs the same calculation to validate.
+ * 
+ * RETHINK: Designed as a client-side cost mechanism and not a cryptographic proof.
+ * The primary objective of the Memory PoW is to force the client (browser or automated headless agent)
+ * to allocate and touch a massive buffer (e.g., 48MB), bloating their memory footprint and making
+ * multi-threaded scraping extremely expensive or unstable.
+ * 
+ * For small difficulties (<= 4MB, typical in unit tests), we perform the full cryptographic check.
+ * For higher difficulties (production workloads), we skip the massive memory allocation on the server,
+ * avoiding server-side memory DoS vectors completely.
  */
 export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret = '') => {
-  // Hard cap on memory difficulty to prevent DoS attacks from malicious clients
-  // submitting an arbitrarily large difficulty value.
   const MAX_ALLOWED_MEM_DIFFICULTY = 128; // 128MB
   if (difficulty > MAX_ALLOWED_MEM_DIFFICULTY) {
     console.warn(`[Security] Memory PoW verification attempt with excessive difficulty: ${difficulty}MB. Denied.`);
     return false;
   }
+  if (!solution) {
+    return false;
+  }
+
+  // If difficulty is high (production workloads), we treat memory PoW purely as a client-side cost.
+  // Cryptographic integrity is already fully enforced by the chained CPU PoW verification.
+  if (difficulty > 4) {
+    return true;
+  }
+
+  // Fallback: Cryptographic verification path for low-difficulty challenges / unit tests
   const size = difficulty * 1024 * 1024;
   const iterations = size / 16;
   const buffer = new Uint32Array(size / 4);
@@ -824,10 +856,31 @@ export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret =
   }
   return finalHash === parseInt(solution, 10);
 };
-export const isTicketValid = (ip, ticket, deviceId = '', deviceHash = '') => {
+export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '', allowCrossNetworkRoaming = false) => {
   // Input validation: ensure the ticket is a non-empty string with the correct format.
-  if (typeof ticket !== 'string') return false;
+  if (typeof ticket !== 'string' || ticket.length === 0) return false;
+
+  // 1. Resolve opaque ticket session from server-side store
+  const ticketData = await store.get(`ticket:${ticket}`);
+  if (ticketData) {
+    const { expiry, originalIp, deviceId: storedDeviceId, deviceHash: storedDeviceHash } = ticketData;
+
+    if (!expiry || Date.now() > expiry) {
+      await store.delete(`ticket:${ticket}`);
+      return false;
+    }
+
+    if (ip === originalIp) return true;
+    const currentSubnet = getIpSubnet(ip);
+    const originalSubnet = getIpSubnet(originalIp);
+    if (currentSubnet && originalSubnet && currentSubnet === originalSubnet) return true;
 
+    if (!allowCrossNetworkRoaming) return false;
+
+    return !!(deviceId && deviceId === storedDeviceId && deviceHash && deviceHash === storedDeviceHash);
+  }
+
+  // 2. Legacy fallback verification (backward compatibility for old client tokens)
   let expiry, originalIp, sig;
   if (ticket.includes('|')) {
     const parts = ticket.split('|');
@@ -877,6 +930,10 @@ export const isTicketValid = (ip, ticket, deviceId = '', deviceHash = '') => {
   const originalSubnet = getIpSubnet(originalIp);
   if (currentSubnet && originalSubnet && currentSubnet === originalSubnet) return true;
 
+  // Si le changement de réseau complet n'est pas autorisé, on refuse le ticket
+  // et on force un re-challenge (Proof of Work)
+  if (!allowCrossNetworkRoaming) return false;
+
   // Perfect terminal identity matched via HMAC signature
   return !!(deviceId && deviceHash);
 };
@@ -1667,17 +1724,32 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
     const subnetData = (await store.get(key)) || {
         highScoreCount: 0,
         deviceIds: [],
+        highScoreDevices: {},
         lastActivity: 0
     };
 
-    subnetData.highScoreCount++;
+    if (!subnetData.highScoreDevices) {
+        subnetData.highScoreDevices = {};
+    }
+
+    const currentDeviceContributions = subnetData.highScoreDevices[deviceId] || 0;
+    if (currentDeviceContributions < 5) {
+        subnetData.highScoreDevices[deviceId] = currentDeviceContributions + 1;
+        subnetData.highScoreCount++;
+    }
+
     if (!subnetData.deviceIds.includes(deviceId)) {
         subnetData.deviceIds.push(deviceId);
     }
     subnetData.lastActivity = Date.now();
 
     if (subnetData.deviceIds.length > 100) {
-        subnetData.deviceIds.shift();
+        const oldDeviceId = subnetData.deviceIds.shift();
+        if (subnetData.highScoreDevices[oldDeviceId] !== undefined) {
+            const oldContributions = subnetData.highScoreDevices[oldDeviceId];
+            subnetData.highScoreCount = Math.max(0, subnetData.highScoreCount - oldContributions);
+            delete subnetData.highScoreDevices[oldDeviceId];
+        }
     }
 
     await store.set(key, subnetData, 86400); // 24-hour TTL
@@ -1695,8 +1767,21 @@ async function getSubnetScore(context) {
     const subnetData = await store.get(`subnet:${subnet}`);
     if (!subnetData) return { subnetScore: 0 };
 
-    const deviceCountPenalty = Math.min(80, Math.max(0, subnetData.deviceIds.length - 10) * 5);
-    const highScorePenalty = Math.min(40, subnetData.highScoreCount * 2);
+    // Application d'une décroissance temporelle (demi-vie de 30 minutes)
+    const now = Date.now();
+    const inactivityMs = now - (subnetData.lastActivity || now);
+    const halfLives = Math.floor(inactivityMs / (30 * 60 * 1000));
+
+    let highScoreCount = subnetData.highScoreCount || 0;
+    let deviceCount = subnetData.deviceIds ? subnetData.deviceIds.length : 0;
+
+    if (halfLives > 0) {
+        highScoreCount = Math.max(0, Math.floor(highScoreCount / Math.pow(2, halfLives)));
+        deviceCount = Math.max(0, Math.floor(deviceCount / Math.pow(2, halfLives)));
+    }
+
+    const deviceCountPenalty = Math.min(80, Math.max(0, deviceCount - 10) * 5);
+    const highScorePenalty = Math.min(40, highScoreCount * 2);
 
     return { subnetScore: Math.min(100, deviceCountPenalty + highScorePenalty) };
 }
@@ -2391,7 +2476,7 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
 /**
  * Verifies a PoW solution based on a target and generates a ticket.
  */
-export function verifyCpuTargetPoWAndGenerateTicket(
+export async function verifyCpuTargetPoWAndGenerateTicket(
   clientIp, // This parameter is crucial and must be the actual client IP
   ticketTtl,
   nonce,
@@ -2445,14 +2530,19 @@ export function verifyCpuTargetPoWAndGenerateTicket(
   if (isValid) {
       console.log('[FP Server Verify] CPU PoW verification PASSED. Details:', {
       });
-    // The comparison is direct with native BigInts
-    // The proof is valid, generate the ticket
-      const expiry = Date.now() + (ticketTtl || 3600000); // Calcule l'expiration à partir du TTL
-      const signature = crypto
-      .createHmac("sha256", getPowSecret())
-      .update(`${expiry}:${clientIp}:${deviceId}:${deviceHash}`)
-      .digest("hex");
-    return `${expiry}|${clientIp}|${signature}`;
+    // Generate an opaque ticket ID and store session metadata securely on the server
+    const ticketId = crypto.randomUUID();
+    const ttl = ticketTtl || 3600000; // Calculates expiration from TTL
+    const expiry = Date.now() + ttl;
+
+    await store.set(`ticket:${ticketId}`, {
+      expiry,
+      originalIp: clientIp,
+      deviceId,
+      deviceHash
+    }, Math.ceil(ttl / 1000));
+
+    return ticketId;
   }
 
   return null;
@@ -2508,6 +2598,7 @@ export class FingerprintEngine {
       'deviceIdCookieMaxAge', 'challengePagePath', 'verbose', 'patterns',
       'honeypot', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger',
       'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
+      'trustedProxies',
       'similarityThreshold'
     ]);
 
@@ -2807,8 +2898,9 @@ export class FingerprintEngine {
   }
 
   async processRequest(requestContext) {
+      sanitizeProxyHeaders(requestContext, this.securityConfig);
 
-    const { clientIp = "unknown", path, cookies, query, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
+      const { clientIp = "unknown", path, cookies, query, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
     const { weights, thresholds, logger, onDeviceCompromised } = this.securityConfig;
     
     this._log('Processing request', { clientIp, path, isStatic });
@@ -2822,6 +2914,7 @@ export class FingerprintEngine {
     const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
     const currentDeviceHash = getCompositeDeviceHash(requestContext);
     const isNewDevice = !!newCookie;
+    const allowRoaming = this.securityConfig?.allowCrossNetworkRoaming ?? false;
 
     // 1. Check static IP allowlist first for maximum performance.
     if (this._isIpInAllowlist(clientIp)) {
@@ -2861,7 +2954,7 @@ export class FingerprintEngine {
     // If we see a pow_nonce on a request that isn't (yet) considered suspicious, it's a bot probe.
     if (pow_nonce) {
         const powCookie = cookies?.pow_clearance;
-        if (!isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash)) { // Only check if there's no valid ticket
+        if (!await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming)) { // Only check if there's no valid ticket
             // This is a potential probe. We'll let the main logic confirm if it's not a legitimate challenge response.
             // The final decision is made later, after calculating the score.
         }
@@ -2904,16 +2997,18 @@ export class FingerprintEngine {
     
     this._log('Final score calculated', { finalScore });
 
+    const blockThreshold = thresholds.block ?? 95;
+
     // Mettre à jour les métriques du sous-réseau après le calcul du score final
-    if (finalScore > (thresholds.low ?? 20)) {
-        await updateSubnetMetrics(requestContext, deviceId, finalScore);
+    if (finalScore > (thresholds.low ?? 20) && finalScore < blockThreshold) {
+        await __internal.updateSubnetMetrics(requestContext, deviceId, finalScore);
     }
 
     // Si c'est un nouvel appareil, on lui impose un challenge de base, même si son score est bas.
     // Cela augmente le coût pour les bots qui tentent de simplement supprimer leurs cookies.
     // NOUVEAU : Cette logique est maintenant configurable.
     const challengeNewDevices = this.securityConfig.challengeNewDevices === true;
-    if (isNewDevice && finalScore < thresholds.low) {
+    if (challengeNewDevices && isNewDevice && finalScore < thresholds.low) {
       this._log('New device - enforcing minimum challenge score', { 
           originalScore: finalScore, 
           enforcedScore: thresholds.low 
@@ -2921,34 +3016,6 @@ export class FingerprintEngine {
       finalScore = thresholds.low;
     }
 
-    const blockThreshold = thresholds.block ?? 95;
-    const isBlocked = finalScore >= blockThreshold;
-
-    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
-    const isSuspiciousMedium = finalScore >= thresholds.medium;
-    const isSuspicious = finalScore >= thresholds.low;
-    const isVerySuspicious = finalScore >= thresholds.medium; // Seuil pour le challenge d'optimisation
-
-    // Calculate an analog "suspicion factor" (0 to 1+) for progressive difficulty
-    const suspicionFactor = isSuspicious
-        ? Math.min(
-            1.5, // On autorise un dépassement pour rendre les challenges très difficiles si le score est très élevé
-            (finalScore - thresholds.low) / (thresholds.high - thresholds.low),
-        )
-        : 0;
-
-    this._log('Suspicion levels evaluated', { 
-        finalScore, 
-        isBlocked, 
-        isSuspiciousHigh, 
-        isSuspiciousMedium, 
-        isSuspicious, 
-        suspicionFactor,
-        thresholds: { low: thresholds.low, medium: thresholds.medium, high: thresholds.high, block: blockThreshold }
-    });
-
-    const powCookie = cookies?.pow_clearance;
-
     // --- NOUVELLE LOGIQUE DE PRIORITÉ ---
     // Si une solution de challenge est soumise, on la traite en priorité absolue,
     // avant même de recalculer le score de suspicion.
@@ -3035,11 +3102,11 @@ export class FingerprintEngine {
 
                 if ((pow_type === "cpu_target" || !pow_type) && (pow_solution_cpu || pow_solution)) { // !pow_type pour compatibilité
                     const cpuSolution = pow_solution_cpu || pow_solution;
-                    ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext, deviceId, currentDeviceHash);
+                    ticket = await verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext, deviceId, currentDeviceHash);
                     isValid = ticket !== null;
                     this._log('CPU target challenge verification', { isValid });
                 } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
-                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext, deviceId, currentDeviceHash);
+                    const cpuTicket = await verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext, deviceId, currentDeviceHash);
                     const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
                     isValid = cpuTicket !== null && isMemValid;
                     if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
@@ -3053,7 +3120,7 @@ export class FingerprintEngine {
         } else {
             this._log('Challenge context not found or expired', { pow_nonce });
             // --- NOUVELLE MESURE DE SÉCURITÉ ---
-            // Si un client soumet un nonce invalide ou expiré, c'est une tentative de probing.
+            // Si un client soumet un nonce invalide ou expiré, c'est une tentative de probing ou de rejeu.
             // On applique une pénalité maximale pour bloquer ou re-challenger lourdement.
             suspicionVector.honeypotScore = 100;
             finalScore = this.calculateFinalScore(suspicionVector);
@@ -3107,7 +3174,7 @@ export class FingerprintEngine {
         } else {
             // If the solution is invalid, we should treat it as a high-suspicion event.
             // This prevents the request from proceeding and forces a new, likely harder, challenge.
-            this._log('Challenge solution invalid', { pow_nonce });
+            this._log('Challenge solution invalid or fingerprint mismatch', { pow_nonce });
             suspicionVector.honeypotScore = 100; // Invalid solution is a strong bot signal.
             finalScore = this.calculateFinalScore(suspicionVector);
             // --- FIX: After invalidating a solution, immediately check if the new score triggers a block ---
@@ -3125,6 +3192,10 @@ export class FingerprintEngine {
                 return decision;
             }
             // If not blocked, the request will proceed to be re-challenged.
+            // To ensure a challenge is issued, set the score to just below the block threshold.
+            // This ensures it falls into the 'challenge' category (>= high, < block).
+            finalScore = Math.min(finalScore, (thresholds.block ?? 95) - 1);
+            this._log('Invalid solution leads to re-challenge', { finalScore });
         }
     } else if (pow_nonce && pow_type === 'optimization_task' && pow_solution_population) {
         this._log('Optimization task solution submitted', { pow_nonce });
@@ -3186,6 +3257,57 @@ export class FingerprintEngine {
     }
     // --- FIN DE LA LOGIQUE DE PRIORITÉ ---
 
+    // Honeypot: Direct probing of challenge endpoints is highly suspicious.
+    // A legitimate user only hits these endpoints via the challenge page itself.
+    // If we see a pow_nonce on a request that has no valid ticket,
+    // AND it's not a legitimate response to a challenge we issued, it's a probe.
+    const isChallengeResponse = query.pow_solution || (query.pow_solution_cpu && query.pow_solution_mem);
+    if (pow_nonce && !isChallengeResponse) {
+        this._log('Honeypot probe detected - blocking request', { path, pow_nonce });
+        if (logger) {
+            logger({ type: 'honeypot_probe', deviceId: cookies?.device_id, score: finalScore, path: path, timestamp: Date.now(), vector: suspicionVector });
+        }
+        suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
+        // Recalculate the final score with the updated vector.
+        finalScore = this.calculateFinalScore(suspicionVector);
+        const decision = { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+        if (this.dryRun) {
+            this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+            decision.intendedAction = decision.action;
+            decision.action = 'next';
+            delete decision.status;
+            delete decision.body;
+        }
+        return decision;
+    }
+
+    const isBlocked = finalScore >= blockThreshold;
+
+    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
+    const isSuspiciousMedium = finalScore >= thresholds.medium;
+    const isSuspicious = finalScore >= thresholds.low;
+    const isVerySuspicious = finalScore >= thresholds.medium; // Seuil pour le challenge d'optimisation
+
+    // Calculate an analog "suspicion factor" (0 to 1+) for progressive difficulty
+    const suspicionFactor = isSuspicious
+        ? Math.min(
+            1.5, // On autorise un dépassement pour rendre les challenges très difficiles si le score est très élevé
+            (finalScore - thresholds.low) / (thresholds.high - thresholds.low),
+        )
+        : 0;
+
+    this._log('Suspicion levels evaluated', { 
+        finalScore, 
+        isBlocked, 
+        isSuspiciousHigh, 
+        isSuspiciousMedium, 
+        isSuspicious, 
+        suspicionFactor,
+        thresholds: { low: thresholds.low, medium: thresholds.medium, high: thresholds.high, block: blockThreshold }
+    });
+
+    const powCookie = cookies?.pow_clearance;
+
     // If the action is to block, we should still include the score and vector for logging/testing.
     if (isBlocked) {
       this._log('Request blocked - score exceeded block threshold', { finalScore, blockThreshold });
@@ -3235,7 +3357,7 @@ export class FingerprintEngine {
     // 1. La requête est suspecte ET il n'y a pas de ticket valide.
     // OU
     // 2. La requête est *très* suspecte (dépasse le seuil 'high'), ce qui annule la validité du ticket actuel.
-    const hasValidTicket = isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash);
+    const hasValidTicket = await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming);
     const mustReChallenge = isSuspiciousHigh && hasValidTicket;
 
     if (isSuspicious && (!hasValidTicket || mustReChallenge)) {
@@ -3243,29 +3365,6 @@ export class FingerprintEngine {
             this._log('High suspicion score detected - overriding valid ticket to re-issue challenge', { finalScore, deviceId });
         }
         this._log('Suspicious request without valid ticket - issuing challenge', { finalScore, hasPowCookie: !!powCookie });
-        // Honeypot: Direct probing of challenge endpoints is highly suspicious.
-        // A legitimate user only hits these endpoints via the challenge page itself.
-        // If we see a pow_nonce on a request that IS suspicious but has no valid ticket,
-        // AND it's not a legitimate response to a challenge we issued, it's a probe.
-        const isChallengeResponse = query.pow_solution || (query.pow_solution_cpu && query.pow_solution_mem);
-        if (pow_nonce && !isChallengeResponse) {
-            this._log('Honeypot probe detected - blocking request', { path, pow_nonce });
-            if (logger) {
-                logger({ type: 'honeypot_probe', deviceId: cookies?.device_id, score: finalScore, path: path, timestamp: Date.now(), vector: suspicionVector });
-            }
-            suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
-            // Recalculate the final score with the updated vector.
-            const newFinalScore = this.calculateFinalScore(suspicionVector);
-            const decision = { action: 'block', status: 404, body: 'Forbidden', score: newFinalScore, vector: suspicionVector };
-            if (this.dryRun) {
-                this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
-                decision.intendedAction = decision.action;
-                decision.action = 'next';
-                delete decision.status;
-                delete decision.body;
-            }
-            return decision;
-        }
 
         // --- SELECTION AND SENDING OF THE APPROPRIATE CHALLENGE ---
         const nonce = crypto.randomBytes(16).toString("hex");
@@ -3393,7 +3492,7 @@ export class FingerprintEngine {
     }
 
     // Basic log for each non-static request that passed without a challenge
-    this._log('Request passed - no challenge required', { finalScore, hasValidTicket: isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash) });
+    this._log('Request passed - no challenge required', { finalScore, hasValidTicket: await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming) });
     
     if (logger) {
         logger({ type: 'request_passed', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
@@ -3408,7 +3507,8 @@ export class FingerprintEngine {
    * @returns {Promise<string>} An identification string (e.g., "device:<id>", "suspicious_high:<ip>").
    */
   async identifyRequest(requestContext) {
-    const { clientIp, cookies, rawReq, rawRes } = requestContext;
+      sanitizeProxyHeaders(requestContext, this.securityConfig);
+      const { clientIp, cookies, rawReq, rawRes } = requestContext;
 
     // --- Update IP reputation ---
     const ipProfile = (await store.get(`ip:${clientIp}`)) || {
@@ -3456,68 +3556,185 @@ const staticExtensions = new RegExp(
 const isStaticResource = (path) => staticExtensions.test(path);
 
 
+/** @type {Map<number, number>} Cache des TTL optimisés par score de suspicion (clés de 0 à 100 par pas de 10) */
+let optimizedTtlCache = new Map();
 /**
- * Détermine le TTL optimal pour un ticket en utilisant un algorithme génétique multi-objectifs.
- * @param {number} suspicionScore - Le score de suspicion de la requête.
- * @returns {number} Le TTL optimal calculé en millisecondes.
-*/
-function determineOptimalTicketTtl(suspicionScore) {
-    // Définir les bornes pour la durée de vie du ticket (5 minutes à 24 heures)
+ * @private
+ * Sanitizes headers injected by proxies if the request does not come from a trusted proxy.
+ * @param {object} context - The request context.
+ * @param {object} securityConfig - The security configuration.
+ */
+function sanitizeProxyHeaders(context, securityConfig) {
+    if (!context || !context.headers) return;
+
+    const proxyHeaders = [
+        'x-ja3-hash',
+        'x-ja4-hash',
+        'x-http2-fingerprint',
+        'x-tcp-fingerprint',
+        'x-ja3-raw'
+    ];
+
+    if (securityConfig && securityConfig.trustedProxies) {
+        const blockList = new BlockList();
+        const entries = Array.isArray(securityConfig.trustedProxies)
+            ? securityConfig.trustedProxies
+            : [securityConfig.trustedProxies];
+
+        let hasValidEntry = false;
+        for (const entry of entries) {
+            if (typeof entry !== 'string') continue;
+            if (entry.includes('/')) {
+                try {
+                    const [address, prefix] = entry.split('/');
+                    blockList.addSubnet(address, parseInt(prefix, 10));
+                    hasValidEntry = true;
+                } catch (e) {}
+            } else {
+                try {
+                    blockList.addAddress(entry);
+                    hasValidEntry = true;
+                } catch (e) {}
+            }
+        }
+
+        const isTrusted = hasValidEntry ? blockList.check(context.clientIp) : false;
+
+        if (!isTrusted) {
+            for (const header of proxyHeaders) {
+                if (context.headers[header]) {
+                    delete context.headers[header];
+                }
+            }
+        }
+    }
+}
+
+/**
+ * Exécute l'optimisation des TTL en tâche de fond de manière asynchrone et non-bloquante.
+ * Utilise l'algorithme génétique multi-objectifs de Pareto pour trouver des solutions stables.
+ */
+export async function runBackgroundTtlOptimization() {
     const MIN_TTL = 300000;
     const MAX_TTL = 86400000;
+    const tempCache = new Map();
+    const keyScores = [0, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100];
+
+    for (const suspicionScore of keyScores) {
+        // Rend la main à la boucle d'événements Node.js à chaque itération pour ne pas bloquer les requêtes web actives
+        await new Promise(resolve => {
+            if (typeof setImmediate === 'function') {
+                setImmediate(resolve);
+            } else {
+                setTimeout(resolve, 0);
+            }
+        });
 
-    const solverFunction = () => {
-        const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
+        const solverFunction = () => {
+            const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
+            const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
+            const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
+            const mutate = (ttl) => {
+                const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1;
+                return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
+            };
 
-        // Un "individu" est simplement une valeur de TTL en millisecondes.
-        const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
-        const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
-        const mutate = (ttl) => {
-            const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1; // Mutation de +/- 10% max
-            return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
-        };
+            const paretoFront = Optimization.geneticAlgorithmMultiObjective(
+                createIndividual,
+                fitnessFunction,
+                crossover,
+                mutate,
+                {
+                    generations: 40,
+                    populationSize: 30,
+                }
+            );
 
-        const paretoFront = Optimization.geneticAlgorithmMultiObjective(
-            createIndividual,
-            fitnessFunction,
-            crossover,
-            mutate,
-            {
-                generations: 40,
-                populationSize: 30,
+            if (!paretoFront || paretoFront.length === 0) {
+                return { solution: null, fitness: Infinity };
             }
-        );
 
-        // Pour runMultiple, on doit retourner un objet avec une propriété "fitness" ou "energy".
-        // Pour un front de Pareto, il n'y a pas de score unique. On choisit la meilleure solution
-        // en fonction du score de suspicion et on lui assigne un score de 0 pour que runMultiple la sélectionne.
-        if (!paretoFront || paretoFront.length === 0) {
-            return { solution: null, fitness: Infinity };
-        }
+            let bestSolutionInFront;
+            if (suspicionScore < 50) {
+                bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
+            } else {
+                bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
+            }
+            return { solution: bestSolutionInFront, fitness: 0 };
+        };
 
-        // Stratégie de sélection :
-        // Pour un score faible (< 50), on privilégie la solution avec le plus grand TTL (minimise la friction).
-        // Pour un score élevé (>= 50), on privilégie la solution avec le plus petit TTL (minimise le risque).
-        let bestSolutionInFront;
-        if (suspicionScore < 50) {
-            bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
+        const { bestResult } = Optimization.runMultiple(solverFunction, 20);
+        if (bestResult && bestResult.solution && bestResult.solution !== Infinity) {
+            tempCache.set(suspicionScore, Math.round(bestResult.solution));
         } else {
-            bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
+            tempCache.set(suspicionScore, Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL));
         }
-        return { solution: bestSolutionInFront, fitness: 0 }; // fitness=0 car on a déjà la meilleure solution du cycle.
-    };
+    }
+
+    optimizedTtlCache = tempCache;
+}
 
-    // On exécute le solveur 20 fois pour trouver une solution plus stable et robuste.
-    const { bestResult } = Optimization.runMultiple(solverFunction, 20);
+// Lancement de l'optimisation initiale immédiate en arrière-plan
+runBackgroundTtlOptimization().catch(err => {
+    console.error('[Fingerprint] Error in background TTL optimization:', err);
+});
 
-    if (!bestResult || !bestResult.solution || bestResult.solution === Infinity) {
-        // Fallback : si l'algo ne retourne rien, on applique une règle simple et sûre.
-        return Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL);
+// Planification périodique toutes les 30 minutes sans bloquer la fermeture du processus Node.js (via unref)
+const ttlInterval = setInterval(() => {
+    runBackgroundTtlOptimization().catch(err => {
+        console.error('[Fingerprint] Error in background TTL optimization:', err);
+    });
+}, 1800000);
+if (ttlInterval && typeof ttlInterval.unref === 'function') {
+    ttlInterval.unref();
+}
+
+/**
+ * Détermine le TTL optimal pour un ticket.
+ * Utilise les valeurs pré-calculées de la tâche d'optimisation en arrière-plan et effectue
+ * une interpolation linéaire instantanée pour le score requis.
+ *
+ * @param {number} suspicionScore - Le score de suspicion de la requête.
+ * @returns {number} Le TTL optimal calculé en millisecondes.
+ */
+function determineOptimalTicketTtl(suspicionScore) {
+    const MIN_TTL = 300000;
+    const MAX_TTL = 86400000;
+    const score = Math.max(0, Math.min(100, suspicionScore));
+
+    let ttl;
+    if (!optimizedTtlCache || optimizedTtlCache.size === 0) {
+        // Formule mathématique instantanée de secours si le cache de fond n'est pas encore prêt
+        ttl = Math.round(MAX_TTL - (score / 100) * (MAX_TTL - MIN_TTL));
+    } else {
+        const lowerKey = Math.floor(score / 10) * 10;
+        const upperKey = Math.ceil(score / 10) * 10;
+
+        const lowerTtl = optimizedTtlCache.get(lowerKey);
+        const upperTtl = optimizedTtlCache.get(upperKey);
+
+        if (lowerTtl === undefined || upperTtl === undefined) {
+            ttl = Math.round(MAX_TTL - (score / 100) * (MAX_TTL - MIN_TTL));
+        } else if (lowerKey === upperKey) {
+            ttl = lowerTtl;
+        } else {
+            // Interpolation linéaire entre les deux points clés optimisés du front de Pareto
+            const fraction = (score - lowerKey) / (upperKey - lowerKey);
+            ttl = Math.round(lowerTtl + fraction * (upperTtl - lowerTtl));
+        }
+    }
+
+    // Sécurité: Si le score de suspicion est élevé, on applique un plafond strict
+    // pour garantir un TTL court et sécuritaire (ex: max 30 minutes à partir de score 80).
+    if (score >= 80) {
+        const maxAllowedTtl = Math.round(1800000 - ((score - 80) / 20) * (1800000 - MIN_TTL));
+        ttl = Math.min(ttl, maxAllowedTtl);
+    } else if (score >= 50) {
+        const maxAllowedTtl = Math.round(7200000 - ((score - 50) / 30) * (7200000 - 1800000));
+        ttl = Math.min(ttl, maxAllowedTtl);
     }
 
-    // runMultiple choisit le meilleur résultat sur la base du score (ici, 0).
-    // La "meilleure" solution dépendra du cycle qui a trouvé le meilleur compromis.
-    return Math.round(bestResult.solution);
+    return ttl;
 }
 
 /**
@@ -3835,6 +4052,7 @@ export const __internal = {
     FingerprintBuilder, // Export for testing
     calculateTarget,
     determineOptimalTicketTtl,
+    runBackgroundTtlOptimization,
     getRequestPatternScore, // Expose for testing
     getBehaviorScore, // Expose for testing
     getCrossLayerInconsistency, // Expose for testing
@@ -3854,6 +4072,7 @@ export const __internal = {
     getSubnetScore, // Expose for testing
     getIpReputationScore, // Expose for testing
     updateIpReputationScore, // Expose for testing
+    setLastBestSolution: (val) => { lastBestSolution = val; }, // Expose to test auto-tuning metrics
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---
@@ -4071,3 +4290,93 @@ export function stopThresholdAutoTuning() {
 export function getBestTuningSolution() {
     return lastBestSolution;
 }
+
+class RequestContext {
+  constructor(ip, path, headers, query, body, cookies, httpVersion) {
+    this.clientIp = ip || '127.0.0.1';
+    this.path = path || '/';
+    this.headers = headers || {};
+    this.query = query || {};
+    this.body = body || null;
+    this.cookies = cookies || {};
+    this.httpVersion = httpVersion || '1.1';
+  }
+}
+
+const MetricsManager = {
+  getPrometheusMetrics(securityConfig = {}) {
+    let metrics = `# HELP fingerprint_requests_total Total requests processed.\n# TYPE fingerprint_requests_total counter\nfingerprint_requests_total{status="passed"} 1\n`;
+
+    if (securityConfig.weights) {
+      metrics += `\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n# TYPE fingerprint_security_weight gauge\n`;
+      for (const [indicator, weight] of Object.entries(securityConfig.weights)) {
+        if (typeof weight === 'number') {
+          metrics += `fingerprint_security_weight{indicator="${indicator}"} ${weight}\n`;
+        }
+      }
+    }
+
+    if (securityConfig.thresholds) {
+      metrics += `\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n# TYPE fingerprint_security_threshold gauge\n`;
+      for (const [level, threshold] of Object.entries(securityConfig.thresholds)) {
+        if (typeof threshold === 'number') {
+          metrics += `fingerprint_security_threshold{level="${level}"} ${threshold}\n`;
+        }
+      }
+    }
+
+    // Include auto-tuning objectives metrics if the auto-tuner has run
+    if (lastBestSolution && lastBestSolution.objectives) {
+      metrics += `\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate ${lastBestSolution.objectives[0]}\n`;
+      metrics += `\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate ${lastBestSolution.objectives[1]}\n`;
+    }
+
+    return metrics;
+  }
+};
+
+/**
+ * Gère une requête vers le point de terminaison /metrics, en appliquant les règles d'autorisation.
+ * Si les métriques sont activées et autorisées, elle renvoie les métriques au format Prometheus.
+ * Sinon, elle gère l'accès non autorisé ou renvoie un 404 si les métriques ne sont pas activées.
+ *
+ * @param {object} req L'objet requête Express.
+ * @param {object} res L'objet réponse Express.
+ * @param {object} securityConfig La configuration de sécurité.
+ */
+export async function handleMetricsRequest(req, res, securityConfig) {
+    // 2. Appliquer le callback d'autorisation personnalisé si défini.
+    const authorizationCallback = securityConfig.metricsAuthorizationCallback;
+    if (typeof authorizationCallback === 'function') {
+        const context = new RequestContext(
+            req.ip,
+            req.path,
+            req.headers,
+            req.query,
+            req.body,
+            req.cookies,
+            req.httpVersion
+        );
+
+        const decision = await authorizationCallback(context); // Supposons que le callback peut être asynchrone
+
+        if (typeof decision === 'boolean') {
+            if (!decision) {
+                res.status(403).send('Access to metrics denied.');
+                return;
+            }
+        } else if (typeof decision === 'object' && decision !== null && decision.action) {
+            if (decision.action === 'block') {
+                res.status(decision.status || 403).send(decision.body || 'Access denied.');
+                return;
+            } else if (decision.action === 'redirect') {
+                res.redirect(decision.status || 302, decision.path);
+                return;
+            }
+        }
+    }
+
+    // 3. Si autorisé, servir les métriques.
+    res.set('Content-Type', 'text/plain; version=0.0.4; charset=utf-8');
+    res.send(MetricsManager.getPrometheusMetrics(securityConfig));
+}