Browser Integrity Check

The check queries the prototype chains of standard objects like Navigator, Window, and Document to detect tampering. Automation frameworks often wrap or stub native functions.

• Prototype Verification: Checks if navigator.plugins is a PluginArray or a generic array.
• Function toString: Calls navigator.geolocation.toString() to verify it returns [native code] rather than a custom stub.
• Property Descriptors: Audits Object.getOwnPropertyDescriptor to ensure standard properties are not marked as non-configurable or non-writable by the automation tool.

The script probes for specific 'leaks' that are unique to headless browsers and automation drivers like Puppeteer, Playwright, and Selenium.

• WebDriver Flag: Evaluates navigator.webdriver, which is true in nearly all automation frameworks unless explicitly suppressed.
• CDP Runtime: Checks for window.chrome and window.chrome.runtime to identify Puppeteer/Playwright connections.
• Headless Dimensions: Detects default headless viewports (e.g., 800x600) or missing window.outerWidth/window.outerHeight differentials that indicate a missing browser chrome.

The check validates that the visual rendering pipeline matches the declared user-agent by testing WebGL and canvas capabilities.

• WebGL Fingerprinting: Renders a 3D scene to a canvas and hashes the output to verify the GPU driver and rendering stack match the claimed OS and browser.
• Canvas Anti-Spoofing: Detects if HTMLCanvasElement.toDataURL() has been overridden to return noise or a static image to mask the real fingerprint.
• Font Enumeration: Checks if the list of installed fonts matches expected system defaults for the platform, as headless environments often lack standard font sets.

The check monitors how the client interacts with the challenge page to distinguish human motor control from scripted interactions.

• Mouse Movement Entropy: Analyzes the micro-movements of the cursor; bots often move in straight lines or instantaneously teleport, while humans exhibit jitter and ballistic curves.
• Keyboard Timing: Measures the delay between keydown and keyup events; scripts often fire both simultaneously or with perfectly uniform intervals.
• Touch Event Validation: On mobile, verifies that ontouchstart events include proper radiusX and rotationAngle values, which synthetic events typically omit.

The collected signals are aggregated into a tamper-proof proof-of-work or integrity token that the server can verify without trusting the client's plaintext claims.

• Obfuscated Payload: The JavaScript is heavily obfuscated and re-evaluated dynamically to prevent static analysis and replay attacks.
• Time-Drift Analysis: Measures the monotonic clock to detect if the browser is running in a slowed-down, debugged, or virtualized time environment.
• Integrity Token: The final payload is cryptographically signed using a challenge-response nonce, ensuring the check wasn't bypassed or replayed by a man-in-the-middle proxy.

A set of techniques that probe for the absence of a visible rendering surface or the presence of automation control flags in the JavaScript environment. Detection methods include:

• Checking for missing browser chrome and viewport dimensions
• Testing for the absence of standard user interaction artifacts
• Identifying Puppeteer, Playwright, or Selenium control properties
• Evaluating rendering performance metrics that diverge from standard builds

A specific JavaScript property (navigator.webdriver) that is set to true by default in browser automation frameworks. This serves as a primary leak point for detecting automated instances. Key characteristics:

• Set to true when browser is launched with --enable-automation flag
• Present in Selenium, Puppeteer, and Playwright by default
• Often targeted by evasion scripts that override the property
• Part of the W3C WebDriver specification for automation identification

A defensive mechanism involving an invisible link or form field hidden from human users via CSS but visible to parsers. When automated scrapers interact with these elements, they are immediately identified and blocked. Implementation strategies:

• CSS display: none or visibility: hidden on form inputs
• Links positioned off-screen using absolute positioning
• Fields marked with tabindex='-1' and autocomplete='off'
• Server-side validation that rejects any request with honeypot data populated

A challenge-response test deployed to determine whether a user is human. Modern implementations range from visual recognition puzzles to invisible risk-analysis engines. Categories include:

• reCAPTCHA v3: Invisible score-based assessment using behavioral biometrics
• hCaptcha: Privacy-focused alternative with image classification challenges
• Proof-of-Work CAPTCHAs: Cryptographic puzzles requiring CPU expenditure
• Friendly CAPTCHAs: Background cryptographic attestation without user interaction

A probabilistic rating assigned to a session or request by a detection engine. This score aggregates multiple signals to determine the likelihood of automation:

• IP Reputation: Historical behavior and threat intelligence feeds
• TLS Fingerprinting: JA4 hash analysis of Client Hello parameters
• Behavioral Analysis: Mouse movements, keystroke timing, scroll patterns
• Environment Integrity: Browser API consistency and prototype chain validation Scores typically range from 0 (definitely human) to 100 (definitely automated).

A security service deployed at the content delivery network edge that uses machine learning and fingerprinting to detect, categorize, and mitigate automated traffic before it reaches the origin server. Capabilities include:

• Real-time JavaScript injection for client-side interrogation
• Fingerprint aggregation across sessions to identify bot networks
• Automated challenge escalation from silent monitoring to blocking
• Integration with WAF and DDoS protection layers for unified defense