RoastMyOpsec

News

Client Hints vs User-Agent String Fingerprinting

July 16, 2022

Client Hints vs User-Agent string fingerprinting is how browsers donate high-entropy client data. The classic User-Agent header is a messy banner every request already sends. User-Agent Client Hints (Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, and high-entropy hints after Accept-CH / Critical-CH) are structured fields the site must request. Asking for model, bitness, or full version is a fingerprinting choice, not a performance freebie. Permissions-Policy can restrict ch-* features. RoastMyOpsec inspects Server and X-Powered-By on the landing response. It does not score Accept-CH, does not freeze a GREASE UA, and does not build a device fingerprint.

The practical difference

UA strings shrink over time by design. Client Hints put the detailed bits behind an explicit request so random third parties do not get them by default. Your origin still gets whatever you Accept-CH. Third-party scripts on your page are a different privacy problem — see trackers vs first-party analytics.

Server banners (X-Powered-By) are origin disclosure. Client Hints are client disclosure. Strip the former; be stingy with the latter.

How to choose what to request

Responsive CSS and a coarse UA or Sec-CH-UA-Mobile are enough for most marketing sites. Do not Accept-CH for model and full version unless a first-party feature truly needs it. Do not freeze a UA in logs as a session key. Critical-CH delays the first paint until hints return — use it only when the response must vary.

SignalWho sends itTypical entropyTakeaway
User-AgentEvery request (legacy)Shrinking, still noisyDo not treat as identity
Sec-CH-UA (low entropy)After brands freeze / defaultBrowser brand, not the laptopUsually enough
Accept-CH high-entropyOnly if you askedModel, full version, bitnessOpt in only with a reason
Server / X-Powered-ByYour originStack versionsStrip; see banners guide

What the roast can prove

Banner headers on the HTML response can surface as findings. Missing or present Accept-CH is not scored. Confirm Permissions-Policy for ch-* if you embed untrusted third parties. Pair with third-party trackers if a tag manager is the one collecting hints.

Common mistakes

The first mistake is Accept-CH: * cargo-cult from a performance blog.

The second mistake is logging high-entropy hints next to emails in analytics.

The third mistake is treating Client Hints as a security header that hides the stack.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Do Client Hints replace stripping Server headers?
No. Hints describe the browser. Server and X-Powered-By describe you. Still strip banners.
Should brochure sites send Accept-CH?
Usually no, or only low-entropy fields you actually branch on. Missing Accept-CH is not a roast F.
Does RoastMyOpsec score Client Hints?
No. It reads origin banners. It does not request or freeze Client Hints.

Sources

Related guides