Safari 13.1 blocks all third‑party cookies by default, removing the primary identifier for 54 % of desktop traffic (StatCounter, 2023). ## Entropy Sources
Modern browsers expose dozens of stable attributes: canvas rendering, WebGL vendor strings, audio context latency, installed fonts, and hardware concurrency. The Panopticlick study measured an average of 18.1 bits of entropy per browser, enough to uniquely identify 94 % of users without any cookies. Canvas fingerprinting alone contributes roughly 5.7 bits because GPU driver differences produce distinct pixel hashes. WebGL adds another 4.2 bits via the UNMASKED_VENDOR_WEBGL and UNMASKED_RENDERER_WEBGL strings, e.g. "ANGLE (Intel, Intel(R) UHD Graphics 620 Direct3D11 vs_5_0 ps_5_0)". AudioContext latency varies by OS scheduler and typically yields 2–3 bits. Takeaway: Prioritize high‑entropy, low‑variability sources (canvas, WebGL) and discard noisy attributes like battery status. ## Client‑Side Collection
Load a lightweight library instead of hand‑rolling each API call. FingerprintJS v3.3.0 (npm package @fingerprintjs/fingerprintjs@3.3.0) bundles the above sources, normalizes them, and returns a 64‑character SHA‑256 hash. Example initialization:
import FingerprintJS from '@fingerprintjs/fingerprintjs';
const fp = await FingerprintJS.load();
const result = await fp.get();
console.log(result.visitorId); // e.g. "a1b2c3d4e5f6..."
Run the script once per session, store the hash in a first‑party cookie with SameSite=Lax; Secure; HttpOnly, and send it to your risk engine via a fetch POST. And avoid localStorage to reduce exposure to XSS. Takeaway: Use a maintained library, hash the raw fingerprint, and transmit only the hash over HTTPS. ## Server‑Side Verification
On the backend, recompute the fingerprint from the same attribute set sent by the client (user‑agent, accept‑language, screen resolution, timezone offset, and the hashed canvas/WebGL values). Compare the server‑side hash with the client‑side hash; a mismatch above a threshold of 12 bits signals a spoofing attempt. FingerprintJS Pro reports a 99.5 % uniqueness rate for the combined hash, so a single‑bit drift usually indicates a legitimate browser update, while a 15‑bit shift often means an automated tool like Selenium or Puppeteer masquerading as a real user. Takeaway: Re‑hash on the server, set a configurable entropy‑difference threshold, and flag sessions that exceed it for step‑up authentication. ## Compliance & Data Minimization
GDPR Article 6(1)(f) permits processing for legitimate interests such as fraud prevention, but you must document the balancing test and provide a clear opt‑out. Store only the salted hash (e.g., HMAC‑SHA256(salt, visitorId)) with a 30‑day TTL; never persist raw attribute vectors. CCPA requires a “Do Not Sell” link, fingerprint hashes are not sold, but you must still honor deletion requests. Implement a /privacy/fingerprint-delete endpoint that purges the hash and associated risk scores. Takeaway: Salt hashes, enforce short retention, and expose a deletion API to satisfy GDPR and CCPA. Deploy the client snippet behind a feature flag today, monitor the entropy‑difference metric for a week, and tune the threshold before rolling out to all traffic.
If this was useful: I packaged a deeper version as Self-Hosted LLM Prompt Library: Generate Production Code Fast.
This article was drafted with AI assistance.
Top comments (0)