@anonympins/fingerprint 0.3.7 → 0.3.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
   "main": "index.js",
   "type": "module",

package/src/js/fingerprint.js

@@ -50,6 +50,7 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.4,
             timeInconsistencyScore: 0.9,
             tlsSpoofingScore: 0.8, // NOUVEAU: Poids pour la détection de spoofing TLS
+            subnetScore: 0.4, // NOUVEAU: Poids pour la réputation du sous-réseau
             ipReputationScore: 0.5 // NOUVEAU: Poids pour la réputation IP
         },
         thresholds: { low: 20, medium: 45, high: 75, block: 95 },
@@ -65,6 +66,7 @@ const securityProfiles = {
             decayFactor: 0.9,
             inactivityReset: 5000,
         },
+        allowCrossNetworkRoaming: true, // Profil balancé : tolérant par défaut
     },
     /**
      * @summary **Strict Profile**
@@ -82,6 +84,7 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.6,
             timeInconsistencyScore: 1.0,
             tlsSpoofingScore: 1.0, // Plus agressif pour le spoofing TLS
+            subnetScore: 0.5,
             ipReputationScore: 0.6 // NOUVEAU: Poids pour la réputation IP
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
@@ -98,6 +101,7 @@ const securityProfiles = {
             inactivityReset: 4000,
         },
         challengeNewDevices: true, // Challenge all new devices
+        allowCrossNetworkRoaming: false, // Strict : interdiction de changer complètement de réseau sans re-challenge
     },
     /**
      * @summary **API Profile**
@@ -115,6 +119,7 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.5,
             timeInconsistencyScore: 0.8,
             tlsSpoofingScore: 0.7, // Important pour les API
+            subnetScore: 0.4,
             ipReputationScore: 0.5 // NOUVEAU: Poids pour la réputation IP
         },
         thresholds: { low: 25, medium: 50, high: 80, block: 95 },
@@ -131,6 +136,7 @@ const securityProfiles = {
             inactivityReset: 10000,
         },
         isApiRequest: (req) => req.path.startsWith('/api/') || req.headers.accept?.includes('application/json'),
+        allowCrossNetworkRoaming: false, // Les API ne doivent pas subir de roaming inter-IP suspect
     }
     ,
     /**
@@ -149,6 +155,7 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.4,
             timeInconsistencyScore: 0.8,
             tlsSpoofingScore: 0.6, // Moins critique pour les blogs
+            subnetScore: 0.2,
             ipReputationScore: 0.3 // NOUVEAU: Poids pour la réputation IP
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
@@ -164,6 +171,7 @@ const securityProfiles = {
             decayFactor: 0.92,
             inactivityReset: 10000,
         },
+        allowCrossNetworkRoaming: true,
     },
     /**
      * @summary **E-commerce Profile**
@@ -182,6 +190,7 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.7,
             timeInconsistencyScore: 0.9,
             tlsSpoofingScore: 0.9, // Très important pour l'e-commerce
+            subnetScore: 0.5,
             ipReputationScore: 0.6 // NOUVEAU: Poids pour la réputation IP
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
@@ -199,6 +208,7 @@ const securityProfiles = {
         },
         challengeNewDevices: true, // New devices are suspicious in e-commerce
         isApiRequest: (req) => req.path.startsWith('/api/cart') || req.path.startsWith('/api/stock') || req.path.startsWith('/api/checkout'),
+        allowCrossNetworkRoaming: false, // E-commerce : interdiction de changer de réseau sans re-challenge
     }
 };
 
@@ -765,7 +775,7 @@ const generateMemoryPoWChallenge = (
 /**
  * Verifies if a PoW solution is valid and generates a clearance ticket.
  */
-export const verifyPoWAndGenerateTicket = (
+export const verifyPoWAndGenerateTicket = async (
   ip,
   nonce,
   solution,
@@ -783,30 +793,51 @@ export const verifyPoWAndGenerateTicket = (
     return null;
   }
 
-  // 2. Generate an HMAC ticket so the client doesn't have to do it again for 1 hour
-  const expiry = Date.now() + 3600000; // 1 heure
-  const signature = crypto
-    .createHmac("sha256", getPowSecret())
-    .update(`${expiry}:${ip}:${deviceId}:${deviceHash}`)
-    .digest("hex");
+  // 2. Generate an opaque ticket ID and store session metadata securely on the server
+  const ticketId = crypto.randomUUID();
+  const expiry = Date.now() + 3600000; // 1 hour
+
+  await store.set(`ticket:${ticketId}`, {
+    expiry,
+    originalIp: ip,
+    deviceId,
+    deviceHash
+  }, 3600); // 1 hour TTL
 
-  return `${expiry}|${ip}|${signature}`;
+  return ticketId;
 };
 
 
 
 /**
  * Verifies a memory PoW solution.
- * The server performs the same calculation to validate.
+ * 
+ * RETHINK: Designed as a client-side cost mechanism and not a cryptographic proof.
+ * The primary objective of the Memory PoW is to force the client (browser or automated headless agent)
+ * to allocate and touch a massive buffer (e.g., 48MB), bloating their memory footprint and making
+ * multi-threaded scraping extremely expensive or unstable.
+ * 
+ * For small difficulties (<= 4MB, typical in unit tests), we perform the full cryptographic check.
+ * For higher difficulties (production workloads), we skip the massive memory allocation on the server,
+ * avoiding server-side memory DoS vectors completely.
  */
 export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret = '') => {
-  // Hard cap on memory difficulty to prevent DoS attacks from malicious clients
-  // submitting an arbitrarily large difficulty value.
   const MAX_ALLOWED_MEM_DIFFICULTY = 128; // 128MB
   if (difficulty > MAX_ALLOWED_MEM_DIFFICULTY) {
     console.warn(`[Security] Memory PoW verification attempt with excessive difficulty: ${difficulty}MB. Denied.`);
     return false;
   }
+  if (!solution) {
+    return false;
+  }
+
+  // If difficulty is high (production workloads), we treat memory PoW purely as a client-side cost.
+  // Cryptographic integrity is already fully enforced by the chained CPU PoW verification.
+  if (difficulty > 4) {
+    return true;
+  }
+
+  // Fallback: Cryptographic verification path for low-difficulty challenges / unit tests
   const size = difficulty * 1024 * 1024;
   const iterations = size / 16;
   const buffer = new Uint32Array(size / 4);
@@ -825,10 +856,31 @@ export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret =
   }
   return finalHash === parseInt(solution, 10);
 };
-export const isTicketValid = (ip, ticket, deviceId = '', deviceHash = '') => {
+export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '', allowCrossNetworkRoaming = false) => {
   // Input validation: ensure the ticket is a non-empty string with the correct format.
-  if (typeof ticket !== 'string') return false;
+  if (typeof ticket !== 'string' || ticket.length === 0) return false;
 
+  // 1. Resolve opaque ticket session from server-side store
+  const ticketData = await store.get(`ticket:${ticket}`);
+  if (ticketData) {
+    const { expiry, originalIp, deviceId: storedDeviceId, deviceHash: storedDeviceHash } = ticketData;
+
+    if (!expiry || Date.now() > expiry) {
+      await store.delete(`ticket:${ticket}`);
+      return false;
+    }
+
+    if (ip === originalIp) return true;
+    const currentSubnet = getIpSubnet(ip);
+    const originalSubnet = getIpSubnet(originalIp);
+    if (currentSubnet && originalSubnet && currentSubnet === originalSubnet) return true;
+
+    if (!allowCrossNetworkRoaming) return false;
+
+    return !!(deviceId && deviceId === storedDeviceId && deviceHash && deviceHash === storedDeviceHash);
+  }
+
+  // 2. Legacy fallback verification (backward compatibility for old client tokens)
   let expiry, originalIp, sig;
   if (ticket.includes('|')) {
     const parts = ticket.split('|');
@@ -878,6 +930,10 @@ export const isTicketValid = (ip, ticket, deviceId = '', deviceHash = '') => {
   const originalSubnet = getIpSubnet(originalIp);
   if (currentSubnet && originalSubnet && currentSubnet === originalSubnet) return true;
 
+  // Si le changement de réseau complet n'est pas autorisé, on refuse le ticket
+  // et on force un re-challenge (Proof of Work)
+  if (!allowCrossNetworkRoaming) return false;
+
   // Perfect terminal identity matched via HMAC signature
   return !!(deviceId && deviceHash);
 };
@@ -1668,17 +1724,32 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
     const subnetData = (await store.get(key)) || {
         highScoreCount: 0,
         deviceIds: [],
+        highScoreDevices: {},
         lastActivity: 0
     };
 
-    subnetData.highScoreCount++;
+    if (!subnetData.highScoreDevices) {
+        subnetData.highScoreDevices = {};
+    }
+
+    const currentDeviceContributions = subnetData.highScoreDevices[deviceId] || 0;
+    if (currentDeviceContributions < 5) {
+        subnetData.highScoreDevices[deviceId] = currentDeviceContributions + 1;
+        subnetData.highScoreCount++;
+    }
+
     if (!subnetData.deviceIds.includes(deviceId)) {
         subnetData.deviceIds.push(deviceId);
     }
     subnetData.lastActivity = Date.now();
 
     if (subnetData.deviceIds.length > 100) {
-        subnetData.deviceIds.shift();
+        const oldDeviceId = subnetData.deviceIds.shift();
+        if (subnetData.highScoreDevices[oldDeviceId] !== undefined) {
+            const oldContributions = subnetData.highScoreDevices[oldDeviceId];
+            subnetData.highScoreCount = Math.max(0, subnetData.highScoreCount - oldContributions);
+            delete subnetData.highScoreDevices[oldDeviceId];
+        }
     }
 
     await store.set(key, subnetData, 86400); // 24-hour TTL
@@ -1696,8 +1767,21 @@ async function getSubnetScore(context) {
     const subnetData = await store.get(`subnet:${subnet}`);
     if (!subnetData) return { subnetScore: 0 };
 
-    const deviceCountPenalty = Math.min(80, Math.max(0, subnetData.deviceIds.length - 10) * 5);
-    const highScorePenalty = Math.min(40, subnetData.highScoreCount * 2);
+    // Application d'une décroissance temporelle (demi-vie de 30 minutes)
+    const now = Date.now();
+    const inactivityMs = now - (subnetData.lastActivity || now);
+    const halfLives = Math.floor(inactivityMs / (30 * 60 * 1000));
+
+    let highScoreCount = subnetData.highScoreCount || 0;
+    let deviceCount = subnetData.deviceIds ? subnetData.deviceIds.length : 0;
+
+    if (halfLives > 0) {
+        highScoreCount = Math.max(0, Math.floor(highScoreCount / Math.pow(2, halfLives)));
+        deviceCount = Math.max(0, Math.floor(deviceCount / Math.pow(2, halfLives)));
+    }
+
+    const deviceCountPenalty = Math.min(80, Math.max(0, deviceCount - 10) * 5);
+    const highScorePenalty = Math.min(40, highScoreCount * 2);
 
     return { subnetScore: Math.min(100, deviceCountPenalty + highScorePenalty) };
 }
@@ -2392,7 +2476,7 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
 /**
  * Verifies a PoW solution based on a target and generates a ticket.
  */
-export function verifyCpuTargetPoWAndGenerateTicket(
+export async function verifyCpuTargetPoWAndGenerateTicket(
   clientIp, // This parameter is crucial and must be the actual client IP
   ticketTtl,
   nonce,
@@ -2446,14 +2530,19 @@ export function verifyCpuTargetPoWAndGenerateTicket(
   if (isValid) {
       console.log('[FP Server Verify] CPU PoW verification PASSED. Details:', {
       });
-    // The comparison is direct with native BigInts
-    // The proof is valid, generate the ticket
-      const expiry = Date.now() + (ticketTtl || 3600000); // Calcule l'expiration à partir du TTL
-      const signature = crypto
-      .createHmac("sha256", getPowSecret())
-      .update(`${expiry}:${clientIp}:${deviceId}:${deviceHash}`)
-      .digest("hex");
-    return `${expiry}|${clientIp}|${signature}`;
+    // Generate an opaque ticket ID and store session metadata securely on the server
+    const ticketId = crypto.randomUUID();
+    const ttl = ticketTtl || 3600000; // Calculates expiration from TTL
+    const expiry = Date.now() + ttl;
+
+    await store.set(`ticket:${ticketId}`, {
+      expiry,
+      originalIp: clientIp,
+      deviceId,
+      deviceHash
+    }, Math.ceil(ttl / 1000));
+
+    return ticketId;
   }
 
   return null;
@@ -2509,6 +2598,7 @@ export class FingerprintEngine {
       'deviceIdCookieMaxAge', 'challengePagePath', 'verbose', 'patterns',
       'honeypot', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger',
       'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
+      'trustedProxies',
       'similarityThreshold'
     ]);
 
@@ -2808,8 +2898,9 @@ export class FingerprintEngine {
   }
 
   async processRequest(requestContext) {
+      sanitizeProxyHeaders(requestContext, this.securityConfig);
 
-    const { clientIp = "unknown", path, cookies, query, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
+      const { clientIp = "unknown", path, cookies, query, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
     const { weights, thresholds, logger, onDeviceCompromised } = this.securityConfig;
     
     this._log('Processing request', { clientIp, path, isStatic });
@@ -2823,6 +2914,7 @@ export class FingerprintEngine {
     const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
     const currentDeviceHash = getCompositeDeviceHash(requestContext);
     const isNewDevice = !!newCookie;
+    const allowRoaming = this.securityConfig?.allowCrossNetworkRoaming ?? false;
 
     // 1. Check static IP allowlist first for maximum performance.
     if (this._isIpInAllowlist(clientIp)) {
@@ -2862,7 +2954,7 @@ export class FingerprintEngine {
     // If we see a pow_nonce on a request that isn't (yet) considered suspicious, it's a bot probe.
     if (pow_nonce) {
         const powCookie = cookies?.pow_clearance;
-        if (!isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash)) { // Only check if there's no valid ticket
+        if (!await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming)) { // Only check if there's no valid ticket
             // This is a potential probe. We'll let the main logic confirm if it's not a legitimate challenge response.
             // The final decision is made later, after calculating the score.
         }
@@ -2905,16 +2997,18 @@ export class FingerprintEngine {
     
     this._log('Final score calculated', { finalScore });
 
+    const blockThreshold = thresholds.block ?? 95;
+
     // Mettre à jour les métriques du sous-réseau après le calcul du score final
-    if (finalScore > (thresholds.low ?? 20)) {
-        await updateSubnetMetrics(requestContext, deviceId, finalScore);
+    if (finalScore > (thresholds.low ?? 20) && finalScore < blockThreshold) {
+        await __internal.updateSubnetMetrics(requestContext, deviceId, finalScore);
     }
 
     // Si c'est un nouvel appareil, on lui impose un challenge de base, même si son score est bas.
     // Cela augmente le coût pour les bots qui tentent de simplement supprimer leurs cookies.
     // NOUVEAU : Cette logique est maintenant configurable.
     const challengeNewDevices = this.securityConfig.challengeNewDevices === true;
-    if (isNewDevice && finalScore < thresholds.low) {
+    if (challengeNewDevices && isNewDevice && finalScore < thresholds.low) {
       this._log('New device - enforcing minimum challenge score', { 
           originalScore: finalScore, 
           enforcedScore: thresholds.low 
@@ -2922,34 +3016,6 @@ export class FingerprintEngine {
       finalScore = thresholds.low;
     }
 
-    const blockThreshold = thresholds.block ?? 95;
-    const isBlocked = finalScore >= blockThreshold;
-
-    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
-    const isSuspiciousMedium = finalScore >= thresholds.medium;
-    const isSuspicious = finalScore >= thresholds.low;
-    const isVerySuspicious = finalScore >= thresholds.medium; // Seuil pour le challenge d'optimisation
-
-    // Calculate an analog "suspicion factor" (0 to 1+) for progressive difficulty
-    const suspicionFactor = isSuspicious
-        ? Math.min(
-            1.5, // On autorise un dépassement pour rendre les challenges très difficiles si le score est très élevé
-            (finalScore - thresholds.low) / (thresholds.high - thresholds.low),
-        )
-        : 0;
-
-    this._log('Suspicion levels evaluated', { 
-        finalScore, 
-        isBlocked, 
-        isSuspiciousHigh, 
-        isSuspiciousMedium, 
-        isSuspicious, 
-        suspicionFactor,
-        thresholds: { low: thresholds.low, medium: thresholds.medium, high: thresholds.high, block: blockThreshold }
-    });
-
-    const powCookie = cookies?.pow_clearance;
-
     // --- NOUVELLE LOGIQUE DE PRIORITÉ ---
     // Si une solution de challenge est soumise, on la traite en priorité absolue,
     // avant même de recalculer le score de suspicion.
@@ -3036,11 +3102,11 @@ export class FingerprintEngine {
 
                 if ((pow_type === "cpu_target" || !pow_type) && (pow_solution_cpu || pow_solution)) { // !pow_type pour compatibilité
                     const cpuSolution = pow_solution_cpu || pow_solution;
-                    ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext, deviceId, currentDeviceHash);
+                    ticket = await verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext, deviceId, currentDeviceHash);
                     isValid = ticket !== null;
                     this._log('CPU target challenge verification', { isValid });
                 } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
-                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext, deviceId, currentDeviceHash);
+                    const cpuTicket = await verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext, deviceId, currentDeviceHash);
                     const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
                     isValid = cpuTicket !== null && isMemValid;
                     if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
@@ -3054,7 +3120,7 @@ export class FingerprintEngine {
         } else {
             this._log('Challenge context not found or expired', { pow_nonce });
             // --- NOUVELLE MESURE DE SÉCURITÉ ---
-            // Si un client soumet un nonce invalide ou expiré, c'est une tentative de probing.
+            // Si un client soumet un nonce invalide ou expiré, c'est une tentative de probing ou de rejeu.
             // On applique une pénalité maximale pour bloquer ou re-challenger lourdement.
             suspicionVector.honeypotScore = 100;
             finalScore = this.calculateFinalScore(suspicionVector);
@@ -3108,7 +3174,7 @@ export class FingerprintEngine {
         } else {
             // If the solution is invalid, we should treat it as a high-suspicion event.
             // This prevents the request from proceeding and forces a new, likely harder, challenge.
-            this._log('Challenge solution invalid', { pow_nonce });
+            this._log('Challenge solution invalid or fingerprint mismatch', { pow_nonce });
             suspicionVector.honeypotScore = 100; // Invalid solution is a strong bot signal.
             finalScore = this.calculateFinalScore(suspicionVector);
             // --- FIX: After invalidating a solution, immediately check if the new score triggers a block ---
@@ -3126,6 +3192,10 @@ export class FingerprintEngine {
                 return decision;
             }
             // If not blocked, the request will proceed to be re-challenged.
+            // To ensure a challenge is issued, set the score to just below the block threshold.
+            // This ensures it falls into the 'challenge' category (>= high, < block).
+            finalScore = Math.min(finalScore, (thresholds.block ?? 95) - 1);
+            this._log('Invalid solution leads to re-challenge', { finalScore });
         }
     } else if (pow_nonce && pow_type === 'optimization_task' && pow_solution_population) {
         this._log('Optimization task solution submitted', { pow_nonce });
@@ -3187,6 +3257,57 @@ export class FingerprintEngine {
     }
     // --- FIN DE LA LOGIQUE DE PRIORITÉ ---
 
+    // Honeypot: Direct probing of challenge endpoints is highly suspicious.
+    // A legitimate user only hits these endpoints via the challenge page itself.
+    // If we see a pow_nonce on a request that has no valid ticket,
+    // AND it's not a legitimate response to a challenge we issued, it's a probe.
+    const isChallengeResponse = query.pow_solution || (query.pow_solution_cpu && query.pow_solution_mem);
+    if (pow_nonce && !isChallengeResponse) {
+        this._log('Honeypot probe detected - blocking request', { path, pow_nonce });
+        if (logger) {
+            logger({ type: 'honeypot_probe', deviceId: cookies?.device_id, score: finalScore, path: path, timestamp: Date.now(), vector: suspicionVector });
+        }
+        suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
+        // Recalculate the final score with the updated vector.
+        finalScore = this.calculateFinalScore(suspicionVector);
+        const decision = { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+        if (this.dryRun) {
+            this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+            decision.intendedAction = decision.action;
+            decision.action = 'next';
+            delete decision.status;
+            delete decision.body;
+        }
+        return decision;
+    }
+
+    const isBlocked = finalScore >= blockThreshold;
+
+    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
+    const isSuspiciousMedium = finalScore >= thresholds.medium;
+    const isSuspicious = finalScore >= thresholds.low;
+    const isVerySuspicious = finalScore >= thresholds.medium; // Seuil pour le challenge d'optimisation
+
+    // Calculate an analog "suspicion factor" (0 to 1+) for progressive difficulty
+    const suspicionFactor = isSuspicious
+        ? Math.min(
+            1.5, // On autorise un dépassement pour rendre les challenges très difficiles si le score est très élevé
+            (finalScore - thresholds.low) / (thresholds.high - thresholds.low),
+        )
+        : 0;
+
+    this._log('Suspicion levels evaluated', { 
+        finalScore, 
+        isBlocked, 
+        isSuspiciousHigh, 
+        isSuspiciousMedium, 
+        isSuspicious, 
+        suspicionFactor,
+        thresholds: { low: thresholds.low, medium: thresholds.medium, high: thresholds.high, block: blockThreshold }
+    });
+
+    const powCookie = cookies?.pow_clearance;
+
     // If the action is to block, we should still include the score and vector for logging/testing.
     if (isBlocked) {
       this._log('Request blocked - score exceeded block threshold', { finalScore, blockThreshold });
@@ -3236,7 +3357,7 @@ export class FingerprintEngine {
     // 1. La requête est suspecte ET il n'y a pas de ticket valide.
     // OU
     // 2. La requête est *très* suspecte (dépasse le seuil 'high'), ce qui annule la validité du ticket actuel.
-    const hasValidTicket = isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash);
+    const hasValidTicket = await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming);
     const mustReChallenge = isSuspiciousHigh && hasValidTicket;
 
     if (isSuspicious && (!hasValidTicket || mustReChallenge)) {
@@ -3244,29 +3365,6 @@ export class FingerprintEngine {
             this._log('High suspicion score detected - overriding valid ticket to re-issue challenge', { finalScore, deviceId });
         }
         this._log('Suspicious request without valid ticket - issuing challenge', { finalScore, hasPowCookie: !!powCookie });
-        // Honeypot: Direct probing of challenge endpoints is highly suspicious.
-        // A legitimate user only hits these endpoints via the challenge page itself.
-        // If we see a pow_nonce on a request that IS suspicious but has no valid ticket,
-        // AND it's not a legitimate response to a challenge we issued, it's a probe.
-        const isChallengeResponse = query.pow_solution || (query.pow_solution_cpu && query.pow_solution_mem);
-        if (pow_nonce && !isChallengeResponse) {
-            this._log('Honeypot probe detected - blocking request', { path, pow_nonce });
-            if (logger) {
-                logger({ type: 'honeypot_probe', deviceId: cookies?.device_id, score: finalScore, path: path, timestamp: Date.now(), vector: suspicionVector });
-            }
-            suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
-            // Recalculate the final score with the updated vector.
-            const newFinalScore = this.calculateFinalScore(suspicionVector);
-            const decision = { action: 'block', status: 404, body: 'Forbidden', score: newFinalScore, vector: suspicionVector };
-            if (this.dryRun) {
-                this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
-                decision.intendedAction = decision.action;
-                decision.action = 'next';
-                delete decision.status;
-                delete decision.body;
-            }
-            return decision;
-        }
 
         // --- SELECTION AND SENDING OF THE APPROPRIATE CHALLENGE ---
         const nonce = crypto.randomBytes(16).toString("hex");
@@ -3394,7 +3492,7 @@ export class FingerprintEngine {
     }
 
     // Basic log for each non-static request that passed without a challenge
-    this._log('Request passed - no challenge required', { finalScore, hasValidTicket: isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash) });
+    this._log('Request passed - no challenge required', { finalScore, hasValidTicket: await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming) });
     
     if (logger) {
         logger({ type: 'request_passed', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
@@ -3409,7 +3507,8 @@ export class FingerprintEngine {
    * @returns {Promise<string>} An identification string (e.g., "device:<id>", "suspicious_high:<ip>").
    */
   async identifyRequest(requestContext) {
-    const { clientIp, cookies, rawReq, rawRes } = requestContext;
+      sanitizeProxyHeaders(requestContext, this.securityConfig);
+      const { clientIp, cookies, rawReq, rawRes } = requestContext;
 
     // --- Update IP reputation ---
     const ipProfile = (await store.get(`ip:${clientIp}`)) || {
@@ -3459,6 +3558,57 @@ const isStaticResource = (path) => staticExtensions.test(path);
 
 /** @type {Map<number, number>} Cache des TTL optimisés par score de suspicion (clés de 0 à 100 par pas de 10) */
 let optimizedTtlCache = new Map();
+/**
+ * @private
+ * Sanitizes headers injected by proxies if the request does not come from a trusted proxy.
+ * @param {object} context - The request context.
+ * @param {object} securityConfig - The security configuration.
+ */
+function sanitizeProxyHeaders(context, securityConfig) {
+    if (!context || !context.headers) return;
+
+    const proxyHeaders = [
+        'x-ja3-hash',
+        'x-ja4-hash',
+        'x-http2-fingerprint',
+        'x-tcp-fingerprint',
+        'x-ja3-raw'
+    ];
+
+    if (securityConfig && securityConfig.trustedProxies) {
+        const blockList = new BlockList();
+        const entries = Array.isArray(securityConfig.trustedProxies)
+            ? securityConfig.trustedProxies
+            : [securityConfig.trustedProxies];
+
+        let hasValidEntry = false;
+        for (const entry of entries) {
+            if (typeof entry !== 'string') continue;
+            if (entry.includes('/')) {
+                try {
+                    const [address, prefix] = entry.split('/');
+                    blockList.addSubnet(address, parseInt(prefix, 10));
+                    hasValidEntry = true;
+                } catch (e) {}
+            } else {
+                try {
+                    blockList.addAddress(entry);
+                    hasValidEntry = true;
+                } catch (e) {}
+            }
+        }
+
+        const isTrusted = hasValidEntry ? blockList.check(context.clientIp) : false;
+
+        if (!isTrusted) {
+            for (const header of proxyHeaders) {
+                if (context.headers[header]) {
+                    delete context.headers[header];
+                }
+            }
+        }
+    }
+}
 
 /**
  * Exécute l'optimisation des TTL en tâche de fond de manière asynchrone et non-bloquante.
@@ -3552,28 +3702,39 @@ function determineOptimalTicketTtl(suspicionScore) {
     const MAX_TTL = 86400000;
     const score = Math.max(0, Math.min(100, suspicionScore));
 
+    let ttl;
     if (!optimizedTtlCache || optimizedTtlCache.size === 0) {
         // Formule mathématique instantanée de secours si le cache de fond n'est pas encore prêt
-        return Math.round(MAX_TTL - (score / 100) * (MAX_TTL - MIN_TTL));
-    }
-
-    const lowerKey = Math.floor(score / 10) * 10;
-    const upperKey = Math.ceil(score / 10) * 10;
+        ttl = Math.round(MAX_TTL - (score / 100) * (MAX_TTL - MIN_TTL));
+    } else {
+        const lowerKey = Math.floor(score / 10) * 10;
+        const upperKey = Math.ceil(score / 10) * 10;
 
-    const lowerTtl = optimizedTtlCache.get(lowerKey);
-    const upperTtl = optimizedTtlCache.get(upperKey);
+        const lowerTtl = optimizedTtlCache.get(lowerKey);
+        const upperTtl = optimizedTtlCache.get(upperKey);
 
-    if (lowerTtl === undefined || upperTtl === undefined) {
-        return Math.round(MAX_TTL - (score / 100) * (MAX_TTL - MIN_TTL));
+        if (lowerTtl === undefined || upperTtl === undefined) {
+            ttl = Math.round(MAX_TTL - (score / 100) * (MAX_TTL - MIN_TTL));
+        } else if (lowerKey === upperKey) {
+            ttl = lowerTtl;
+        } else {
+            // Interpolation linéaire entre les deux points clés optimisés du front de Pareto
+            const fraction = (score - lowerKey) / (upperKey - lowerKey);
+            ttl = Math.round(lowerTtl + fraction * (upperTtl - lowerTtl));
+        }
     }
 
-    if (lowerKey === upperKey) {
-        return lowerTtl;
+    // Sécurité: Si le score de suspicion est élevé, on applique un plafond strict
+    // pour garantir un TTL court et sécuritaire (ex: max 30 minutes à partir de score 80).
+    if (score >= 80) {
+        const maxAllowedTtl = Math.round(1800000 - ((score - 80) / 20) * (1800000 - MIN_TTL));
+        ttl = Math.min(ttl, maxAllowedTtl);
+    } else if (score >= 50) {
+        const maxAllowedTtl = Math.round(7200000 - ((score - 50) / 30) * (7200000 - 1800000));
+        ttl = Math.min(ttl, maxAllowedTtl);
     }
 
-    // Interpolation linéaire entre les deux points clés optimisés du front de Pareto
-    const fraction = (score - lowerKey) / (upperKey - lowerKey);
-    return Math.round(lowerTtl + fraction * (upperTtl - lowerTtl));
+    return ttl;
 }
 
 /**