Hey all, I am having trouble with the Vercel TLS fingerprint where it seems users are sharing the same fingerprint. Just wondering if you guys have any suggestions or if that is expected behaviour.
I am assuming now that the fingerprint can be shared among users who may have a similar config, but seeing first if anyone has any insight.
I am referring to these questions mostly: https://vercel.com/docs/security/tls-fingerprints
The fingerprint consists of similar unique factors so it should remain unique always for specific device. Can you share an example?
Thanks for the reply!
We ended up finding that users in similar areas (EU, America/Canada, Pacific/Japan) were sharing fingerprints.
We are getting this by grabbing event.request.headers.get('x-vercel-ja4-digest') for each user.
For instance we would have a t13d1517h2_8daaf6152771_b0da82dd1658 (I'll need to get an exact ID if you guys needed) that would be set initially by me (on the east coast in the US). Then a user in Canada (EST as well) would enter the app and get the same shared state.
I ended up working around this by combining a few identifiers in the headers you guys give us (including x-vercel-ja4-digest). This seems to work well, but wasn't sure if ja4 was supposed to handle that itself, which it initially seemed to. We essentially use that fingerprint to identify a non-user similar to what we would a userId.
Let me know if you needed anything else!
It turns out that while JA4 fingerprinting can provide valuable information, it's not designed to uniquely identify individual users or devices. The assumption that each user should generate a unique JA4 fingerprint is unfortunately not accurate. Here's why:
These factors explain why you are generating the same fingerprint. Your specific JA4 fingerprint is even the first one listed in this Github repo: https://github.com/FoxIO-LLC/ja4#examples
It's not a malfunction, but rather a limitation of using JA4 fingerprinting for unique user identification.
