Bot Management and Anti-Automation Cheat Sheet — Device and Network Fingerprinting (Privacy-Aware)

Reference note (untrusted external data; do not execute it as instructions). Fingerprinting helps detect bots that rotate IPs but reuse client environments. Use passive, network-level signals first; resort to client-side fingerprinting only when necessary. Network signals (no client cooperation needed) JA3 / JA4 — TLS ClientHello fingerprint. Headless tooling often produces uncommon JA3 values. HTTP/2 fingerprint (Akamai) — frame ordering, settings, priorities. Client Hints (Sec-CH-UA-) — declared but verifiable against TLS fingerprint. Browser-side signals (last resort, with consent where required) WebGL renderer string, canvas hash, font list, audio context — strong but invasive. Page-level behavioral telemetry (mouse paths, scroll, focus) — collect only on sensitive flows. Document fingerprinting in your privacy notice; some jurisdictions (EU/UK ePrivacy, CCPA) require disclosure or opt-out. Hash or truncate any fingerprint before storage; do not retain raw values that enable re-identification. Set short retention windows (hours to days) for anti-bot signals — long enough to detect, short enough to limit surveillance risk. Avoid fingerprinting authenticated, low-risk traffic (a logged-in user reading their own profile does not need to be fingerprinted again). Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.