I work on OnePassApps, so this is our own site, and every number below was measured today, 10 November 2026, from outside the browser, signed out, over plain HTTPS.
There is one browser-to-server channel we have never written about: client hints. A browser can volunteer a few facts about itself - Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version - but only after a server asks for them with an Accept-CH header. A server can also ask for the high-entropy hints with Critical-CH, or ask the browser to reuse a live connection with Early-Data.
We asked whether app.onepassapps.com wants any of that. On every page, the answer is no.
What I measured
- 56 URLs from our own sitemap.xml, each fetched three ways: a plain browser request, the same request carrying five client-hint headers (the four Sec-CH-UA headers plus Accept-CH), and the same request with a curl user-agent and no hints at all
- the same 56 pages once more with
Accept-Encoding: gzip, to see whether the answer changes when the bytes are compressed - 7 public routes on our own API host, each fetched twice, plain and with the client-hint headers
- 238 requests in total, one server, one build, one region, no session and no cookies
Not one page asks
Across the 56 pages: 0 carry Accept-CH, 0 carry Critical-CH, 0 carry Early-Data, and 0 echo a Sec-CH-* response header. There is exactly one header-name set across all 56 pages - 22 names - and it is the same set on every page and on every request: access-control-allow-origin, alt-svc, cache-control, cf-cache-status, cf-ray, connection, content-security-policy, content-type, cross-origin-opener-policy, cross-origin-resource-policy, date, nel, permissions-policy, referrer-policy, report-to, server, server-timing, strict-transport-security, transfer-encoding, x-content-type-options, x-frame-options, x-permitted-cross-domain-policies.
Because no page sends Accept-CH, a real browser never volunteers the low-entropy hints to us in the first place. We sent them anyway, by hand, to find out what the server would do with them.
Nothing moves when you send them
All 56 pages answered 200 in all three request shapes (56 of 56). The header names were identical in all three (56 of 56), and so were the header values once the volatile names are set aside - cf-ray, date, server-timing, report-to and nel (56 of 56 with the hints, 56 of 56 with the curl request). The content-security-policy header came back byte for byte the same either way (56 of 56).
So the answer to our site does not depend on the client's self-description at all, and it does not depend on the user-agent either.
The bytes do change, but not because of hints
Two requests to the same URL never return the same bytes here, and we wrote about that separately: The Same URL Never Returns the Same Bytes. The moving part is Cloudflare's own email-protection key - every response carries a /cdn-cgi/l/email-protection# link and a data-cfemail value, and that hex is fresh on every request, hinted or not.
The API host asks for less, not more
Our API host answered the 7 public routes with 33 header names, and it sent no Accept-CH and no Sec-CH-* echo either, not even when the request asked for them (0 of 7 when we asked, 0 of 7 when we did not). What it does vary on is the request: the routes split across 3 Vary values - Accept-Encoding, Origin, Authorization, Cookie, Accept-Encoding, Origin, Origin - and every one of them is marked private, no-store, max-age=0.
What this does and does not say
It says the browser's description of itself never reaches our pages or our API responses, so there is no client-fingerprint layer to reason about. It does not say our site negotiates nothing: with Accept-Encoding: gzip the 56 of 56 pages do carry a Vary header, where the identity responses carry none (0 of 56) - that is the transfer layer, which we have written about separately. This is one build, one day, one region, and client hints are one negotiation mechanism among several.
Everything above is about the HTTP layer of our own site. The apps themselves are the point of it: 56 pages of tools that run in the tab. Start here: https://app.onepassapps.com?utm_source=devto&utm_medium=post&utm_campaign=client-hints-layer&utm_content=app-link
The guides for each one are here: https://app.onepassapps.com/guides?utm_source=devto&utm_medium=post&utm_campaign=client-hints-layer&utm_content=guides-link
I work on OnePassApps, the team behind app.onepassapps.com. Every number in this post was measured on our own host on 10 November 2026.
Top comments (0)