FoxIO-LLC / ja4

JA4+ is a suite of network fingerprinting standards
https://foxio.io
Other
775 stars 65 forks source link

JA4H should be case-sensitive only for "Cookie" and "Referer" fields #42

Closed noeltimothy closed 5 months ago

noeltimothy commented 6 months ago

When computing JA4H, we need to relax sesitivity oon the "Cookie" and "Referer" fields present in the HTTP headers. All other header fields and values should be case-sensitive.

john-althouse commented 5 months ago

So when recording the headers, they should be recorded case sensitive, but when looking for "Cookie" and "Referer" the search for those headers should be case insensitive.

noeltimothy commented 5 months ago

Yes John, got it.