Learning objectives
After reading this article you will be able to:
- Separate passive request data from active measurements
- Follow a rendering test from input to result
- Explain differences between fingerprint reports
Information sent with the request
The server receives connection information and the headers included in a request.
Examples include a source IP address, User-Agent and language preferences. Which headers appear depends on the browser, request context and configuration. A page does not need to draw a Canvas image for the server to receive an HTTP request.
Cookies matching the request’s scope may also be sent. These are saved values associated with the site, so keep them separate from information measured from the current browser.
Information read through browser APIs
JavaScript can query supported APIs for information about the current page environment.
| Method | Example | What affects the result |
|---|---|---|
| Read a browser property | Language preferences or touch capability | Browser support and privacy settings |
| Measure the page | Viewport dimensions | Window size, zoom and layout |
| Request a protected capability | Geolocation | Permission, security context and availability |
Unavailable data can mean unsupported functionality, a denied request, script blocking or a test error. It is useful to record the reason instead of treating every empty field as concealment.
Information measured from output
A rendering test supplies an input, obtains an output and often calculates a hash.
For Canvas, the input may be text, shapes and colors. The output is pixel data. A hash makes comparison convenient, but its meaning depends on the sample, output processing and hash method. Two sites can report different hashes because their tests differ.
For a useful comparison, keep the test page and settings fixed. Record the browser version, rerun the test, and then change one condition. This separates a change in the environment from a change in the measurement.
Why collection methods belong in a report
Showing where a value came from turns a long list of fields into something you can investigate. A header mismatch, a blocked API and a changed rendering sample call for different follow-up checks.
Interpreting the result
- An available API does not establish that every website uses it.
- Browser permissions and privacy protections can reduce or alter the observations.
- A hash from one test is comparable only within a compatible measurement method.
Frequently asked questions
Does fingerprinting always need JavaScript?
No. Servers can observe request and connection properties without page JavaScript. Many richer browser and rendering checks use scripts.
Why does one test show more fields than another?
The tests may query different APIs, use different permissions or apply different interpretation rules. Compare their methods and named fields.
Does reading a field mean the site stores it?
Collection, transmission and retention are separate steps. A visible test result alone does not describe every server-side storage decision.