nodejs / nodejs/undici

Make TLS Fingerprint great again

Open
#1,983 4 comments 32 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
JavaScript
Stars
7.7k
Forks
880
Avg merge
2d 16h
Merged PRs (30d)
68

Description

Many web firewall applications like Cloudflare implemented new anti DDoS system based on TLS Fingerprinting,
they are whitelisting of up-to-date browsers , we can not send http/s requests to servers behind of such new style firewalls , because we are identified as like DDoS bots, while most of us are just trying to scrape or send API requests.

there is also a very well documented nice blog post that i suggest you to read if you want to learn deeper reasons and results about it

https://httptoolkit.com/blog/tls-fingerprinting-node-js/

Currently, there is no a comfortable way to impersonate a browser's fingerprint in nodejs,

you can checkout your tool's or browser's fingerprint from this link
https://check.ja3.zone/

there is a already solution for curl here

https://github.com/lwthiker/curl-impersonate

a Golang based solution for nodejs which i didn't like

https://github.com/depicts/got-tls

if there could be a lower-level way to impersonate browsers tls fingerprints in nodejs ,

i can

ciphers: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384',

in request package but which is not helping yet to mimic browsers.

i personally would be very very glad, don't know what community thinks.

best regards

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file, test, or entry point is identified. Start by reading the linked HTTP Toolkit article and comparing curl-impersonate with got-tls, then inspect Undici's existing TLS request options. Done would require a defined browser-fingerprint impersonation capability and a way to verify the resulting fingerprint against ja3.zone.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
22/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.