News
Client Hints vs User-Agent String Fingerprinting
July 16, 2022
Client Hints vs User-Agent string fingerprinting is how browsers donate high-entropy client data. The classic User-Agent header is a messy banner every request already sends. User-Agent Client Hints (Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, and high-entropy hints after Accept-CH / Critical-CH) are structured fields the site must request. Asking for model, bitness, or full version is a fingerprinting choice, not a performance freebie. Permissions-Policy can restrict ch-* features. RoastMyOpsec inspects Server and X-Powered-By on the landing response. It does not score Accept-CH, does not freeze a GREASE UA, and does not build a device fingerprint.
The practical difference
UA strings shrink over time by design. Client Hints put the detailed bits behind an explicit request so random third parties do not get them by default. Your origin still gets whatever you Accept-CH. Third-party scripts on your page are a different privacy problem — see trackers vs first-party analytics.
Server banners (X-Powered-By) are origin disclosure. Client Hints are client disclosure. Strip the former; be stingy with the latter.
How to choose what to request
Responsive CSS and a coarse UA or Sec-CH-UA-Mobile are enough for most marketing sites. Do not Accept-CH for model and full version unless a first-party feature truly needs it. Do not freeze a UA in logs as a session key. Critical-CH delays the first paint until hints return — use it only when the response must vary.
| Signal | Who sends it | Typical entropy | Takeaway |
|---|---|---|---|
| User-Agent | Every request (legacy) | Shrinking, still noisy | Do not treat as identity |
| Sec-CH-UA (low entropy) | After brands freeze / default | Browser brand, not the laptop | Usually enough |
| Accept-CH high-entropy | Only if you asked | Model, full version, bitness | Opt in only with a reason |
| Server / X-Powered-By | Your origin | Stack versions | Strip; see banners guide |
What the roast can prove
Banner headers on the HTML response can surface as findings. Missing or present Accept-CH is not scored. Confirm Permissions-Policy for ch-* if you embed untrusted third parties. Pair with third-party trackers if a tag manager is the one collecting hints.
Common mistakes
The first mistake is Accept-CH: * cargo-cult from a performance blog.
The second mistake is logging high-entropy hints next to emails in analytics.
The third mistake is treating Client Hints as a security header that hides the stack.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Do Client Hints replace stripping Server headers?
- No. Hints describe the browser. Server and X-Powered-By describe you. Still strip banners.
- Should brochure sites send Accept-CH?
- Usually no, or only low-entropy fields you actually branch on. Missing Accept-CH is not a roast F.
- Does RoastMyOpsec score Client Hints?
- No. It reads origin banners. It does not request or freeze Client Hints.