Fingerprinting Header

[qudo-code]

Summary

Logging the headers in both a preview environment as well as production and can't find the x-vercel-ja4-digest header that the docs say should be included on all deployments from what I understand. Do I need to enable fingerprinting somehow/somewhere?
https://vercel.com/docs/security/tls-fingerprints#x-vercel-ja4-digest-preferred

Example

No response

Steps to Reproduce

const fingerprint = request.headers.get("x-vercel-ja4-digest");
console.log(fingerprint); // undefined

[pawlean]

Hi @qudo-code!

You're right - it should be switched on by default. What is your app/project set-up like?

[qudo-code]

What do you mean? Is there a toggle I can switch on somewhere? Couldn't tell if you meant like "yeah, we should make that a default" or it should be a default as is. But we have a pretty basic set of Next and SvelteKit apps. Recently been testing logging headers on one of our SvelteKit apps.

[qudo-code]

Just deployed a fresh SvelteKit app to test again on my own Vercel account.

Here's the headers log:

{
  'accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8',
  'accept-encoding' => 'gzip',
  'accept-language' => 'en-US,en;q=0.6',
  'cache-control' => 'max-age=0',
  'connection' => 'close',
  'forwarded' => 'for=212.102.51.244;host=cyfrin-sandbox.vercel.app;proto=https;sig=0QmVhcmVyIGNjZTc3NjEzMWFhZDdiNGYwZjI0YmI4MTRkODNiY2E2NjYxNDlmNDYwNTlkNGY4MDljZThmNGEzZGNjZTgxM2U=;exp=1720546724',
  'host' => 'cyfrin-sandbox.vercel.app',
  'priority' => 'u=0, i',
  'sec-ch-ua' => '"Not/A)Brand";v="8", "Chromium";v="126", "Brave";v="126"',
  'sec-ch-ua-mobile' => '?0',
  'sec-ch-ua-platform' => '"macOS"',
  'sec-fetch-dest' => 'document',
  'sec-fetch-mode' => 'navigate',
  'sec-fetch-site' => 'none',
  'sec-fetch-user' => '?1',
  'sec-gpc' => '1',
  'upgrade-insecure-requests' => '1',
  'user-agent' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
  'x-forwarded-for' => '212.102.51.244',
  'x-forwarded-host' => 'cyfrin-sandbox.vercel.app',
  'x-forwarded-proto' => 'https',
  'x-real-ip' => '212.102.51.244',
  'x-vercel-deployment-url' => 'cyfrin-sandbox-ms8dzsov5-qudos-projects.vercel.app',
  'x-vercel-forwarded-for' => '212.102.51.244',
  'x-vercel-id' => 'hnd1::8czq2-1720546424185-f25ca4950d8d',
  'x-vercel-ip-as-number' => '212238',
  'x-vercel-ip-city' => 'Tokyo',
  'x-vercel-ip-continent' => 'AS',
  'x-vercel-ip-country' => 'JP',
  'x-vercel-ip-country-region' => '13',
  'x-vercel-ip-latitude' => '35.6893',
  'x-vercel-ip-longitude' => '139.6899',
  'x-vercel-ip-timezone' => 'Asia/Tokyo',
  'x-vercel-proxied-for' => '212.102.51.244',
  'x-vercel-proxy-signature' => 'Bearer cce776131aad7b4f0f24bb814d83bca666149f46059d4f809ce8f4a3dcce813e',
  'x-vercel-proxy-signature-ts' => '1720546724'
}

Here's the endpoint:

export const GET = async (event: RequestEvent) => {
    const headers = new Map(event.request.headers);

    console.log("HEADERS", headers);

    return new Response("Hello from server!");
}

Here's the app if it helps debug on your end:
https://cyfrin-sandbox.vercel.app/api

I am going to deploy a Next app next to see if its SvelteKit stripping something but I kinda doubt it.

[qudo-code]

Fresh NextJS app on free Vercel plan:

Headers log:

{
  'accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8',
  'accept-encoding' => 'gzip',
  'accept-language' => 'en-US,en;q=0.8',
  'connection' => 'close',
  'forwarded' => 'for=212.102.51.244;host=cyfrin-sandbox-next.vercel.app;proto=https;sig=0QmVhcmVyIDZmZGRkZjAwZWFmZTljZTZhZTk2NmMxNzg1ZmNmZDI1OTQzZGMwNzQ2NWMyMjRkOTJjYTJlYzM5MTgzYzZiYjE=;exp=1720549137',
  'host' => 'cyfrin-sandbox-next.vercel.app',
  'priority' => 'u=0, i',
  'sec-ch-ua' => '"Not/A)Brand";v="8", "Chromium";v="126", "Brave";v="126"',
  'sec-ch-ua-mobile' => '?0',
  'sec-ch-ua-platform' => '"macOS"',
  'sec-fetch-dest' => 'document',
  'sec-fetch-mode' => 'navigate',
  'sec-fetch-site' => 'none',
  'sec-fetch-user' => '?1',
  'sec-gpc' => '1',
  'upgrade-insecure-requests' => '1',
  'user-agent' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
  'x-forwarded-for' => '212.102.51.244',
  'x-forwarded-host' => 'cyfrin-sandbox-next.vercel.app',
  'x-forwarded-port' => '443',
  'x-forwarded-proto' => 'https',
  'x-matched-path' => '/api',
  'x-real-ip' => '212.102.51.244',
  'x-vercel-deployment-url' => 'cyfrin-sandbox-next-ptdqd631x-qudos-projects.vercel.app',
  'x-vercel-forwarded-for' => '212.102.51.244',
  'x-vercel-id' => 'hnd1::h8jg7-1720548837805-d294d0062450',
  'x-vercel-ip-as-number' => '212238',
  'x-vercel-ip-city' => 'Tokyo',
  'x-vercel-ip-continent' => 'AS',
  'x-vercel-ip-country' => 'JP',
  'x-vercel-ip-country-region' => '13',
  'x-vercel-ip-latitude' => '35.6893',
  'x-vercel-ip-longitude' => '139.6899',
  'x-vercel-ip-timezone' => 'Asia/Tokyo',
  'x-vercel-proxied-for' => '212.102.51.244',
  'x-vercel-proxy-signature' => 'Bearer 6fdddf00eafe9ce6ae966c1785fcfd25943dc07465c224d92ca2ec39183c6bb1',
  'x-vercel-proxy-signature-ts' => '1720549137',
  'x-vercel-sc-basepath' => '',
  'x-vercel-sc-headers' => '{"Authorization":"Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkZXBsb3ltZW50SWQiOiJkcGxfSjNzUzc0VFFwR2Q0OWE1WWJtbW9INUdGdThuSCIsInVubGltaXRlZCI6ZmFsc2UsInBsYW4iOiJob2JieSIsImRvbWFpbiI6ImN5ZnJpbi1zYW5kYm94LW5leHQudmVyY2VsLmFwcCIsImJsb2NrIjpmYWxzZSwiaWF0IjoxNzIwNTQ4ODM4LCJwcm9qZWN0SWQiOiJwcmpfUmxrUzVRaEFFd2xscDFoUndzaFpvQ1d5dzFaZyIsImV4cCI6MTcyMDU0OTc1OCwib3duZXJJZCI6InRlYW1fNXhHWXB3bXdOMG5SODNYV2o5V3RpSmRGIiwicmVxdWVzdElkIjoiaDhqZzctMTcyMDU0ODgzNzgwNS1kMjk0ZDAwNjI0NTAiLCJlbnYiOiJwcm9kdWN0aW9uIn0.5cja39U9FKdFtmTF6Om1IfWTFWpU75QhIuCzSsOES2M"}',
  'x-vercel-sc-host' => 'iad1.suspense-cache.vercel-infra.com'
}

Endpoint:

export async function GET(request: Request) {

    const headers = new Map(request.headers);

    console.log("HEADERS", headers);
   
    return new Response("Hello from server!")
}

App:
https://cyfrin-sandbox-next.vercel.app/api

[pawlean]

Hi @qudo-code!

We're deploying a fix for this tomorrow. I'll update you when it's live. Thanks again for reporting!

[github-actions[bot]]

This discussion was automatically locked because the community moved to a new site. Please join us at vercel.community