https://github.com/rushiimachine/caddy-ja3

A caddy plugin that gets JA3 TLS fingerprints from requests.
https://github.com/rushiimachine/caddy-ja3

caddy caddy-plugin go ja3 tls tls-fingerprint

Last synced: 3 months ago
JSON representation

A caddy plugin that gets JA3 TLS fingerprints from requests.

• Host: GitHub
• URL: https://github.com/rushiimachine/caddy-ja3
• Owner: rushiiMachine
• License: apache-2.0
• Created: 2023-07-26T19:15:25.000Z (almost 2 years ago)
• Default Branch: master
• Last Pushed: 2025-01-01T19:24:36.000Z (6 months ago)
• Last Synced: 2025-04-06T06:14:56.206Z (3 months ago)
• Topics: caddy, caddy-plugin, go, ja3, tls, tls-fingerprint
• Language: Go
• Homepage:
• Size: 94.7 KB
• Stars: 22
• Watchers: 1
• Forks: 4
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# caddy-ja3

A caddy plugin to get JA3 fingerprints from requests as a header.

## Building with xcaddy

```shell

xcaddy build \

  --with github.com/rushiiMachine/caddy-ja3

```

## Sample Caddyfile

Note that this enforces HTTPS (TLS).\

You can add a http_redirect to automatically redirect `http` -> `https` like shown below.

TLS `ClientHello`s do not exist on HTTP/3 connections.

No `ja3` header will be present on such requests.

Unless another way is used to fingerprint HTTP/3 aka. QUIC connections, it's recommended to disable HTTP/3.

This module also disables TLS session resumption globally to always retrieve a full `ClientHello`.

This is done through the usage of

[caddytls's `session_tickets/disabled`](https://caddyserver.com/docs/modules/tls#session_tickets/disabled)

config option internally.

```caddyfile

{

    # If using a different responder like reverse_proxy, change this accordingly

    order ja3 before respond

    ja3 {

        # (Optional) Sort TLS extensions to counteract randomizing on modern browsers

        # More info: https://github.com/salesforce/ja3/issues/88

        sort_extensions

    }

    servers {

        # Disable HTTP/3

        protocols h1 h2

        listener_wrappers {

            http_redirect

            ja3

            tls

        }

    }

}

localhost {

    ja3

    # Configure your TLS however you want

    tls internal

    # JA3 fingerprint is added to the request as the "JA3" header

    respond "Your JA3: {header.ja3}"

}

```