@anonympins/fingerprint 0.3.7 → 0.3.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/CHANGELOG.md +12 -0
  2. package/README.md +29 -1176
  3. package/package.json +1 -1
  4. package/src/js/fingerprint.js +264 -103
  5. package/src/php/Challenge/ChallengeUtils.php +64 -8
  6. package/src/php/Utils/RequestUtils.php +1169 -1142
package/CHANGELOG.md CHANGED
@@ -1,3 +1,15 @@
1
+ ## Version 0.3.8
2
+
3
+ ### 🎫 Opaque Tickets Implementation (JS/PHP)
4
+ - **Opaque Clearance Tickets**: Upgraded clearance tickets to use cryptographically secure, random, and opaque token identifiers. This completely mitigates client-side prediction, token tampering, and replay/unauthorized reuse.
5
+ - **PHP Parity**: Implemented secure opaque ticket handling and validation inside the PHP engine to match the Node.js architecture.
6
+
7
+ ### 🌐 Independent Subnet Score (JS/PHP)
8
+ - **Independent Subnet Scoring**: Decoupled and isolated the subnet activity and reputation calculation from individual host/device threat vectors. This ensures distributed crawler attacks on specific IP ranges are mitigated at the subnet level without cascading penalties to unaffected neighboring residential IPs.
9
+
10
+ ### 🛡️ Reverse Proxy Header Spoofing Protection (JS)
11
+ - **Trusted Proxies verification**: Added `trustedProxies` configuration to restrict proxy-injected headers (`X-JA3-Hash`, `X-JA4-Hash`, `X-HTTP2-Fingerprint`, `X-TCP-Fingerprint`, `X-JA3-Raw`) only to requests originating from configured trusted proxy IPs/networks. Unauthenticated clients attempting to send these headers will have them automatically stripped.
12
+
1
13
  ## Version 0.3.7
2
14
 
3
15
  ### 📊 Prometheus Metrics & Monitoring (JS/PHP)