diff --git a/src/content/docs/bots/concepts/ja3-ja4-fingerprint.mdx b/src/content/docs/bots/concepts/ja3-ja4-fingerprint.mdx index e343778ddefb81..65da4e485388f2 100644 --- a/src/content/docs/bots/concepts/ja3-ja4-fingerprint.mdx +++ b/src/content/docs/bots/concepts/ja3-ja4-fingerprint.mdx @@ -1,6 +1,6 @@ --- pcx_content_type: concept -title: JA3/JA4 Fingerprint +title: JA3/JA4 fingerprint --- @@ -72,6 +72,8 @@ When JA4 Signals are missing, the output appears as follows: This sample was generated using [Workers' Cloudflare Object script](/workers/examples/accessing-the-cloudflare-object/). ::: + + ## Analytics To get more information about potential bot requests, use these JA3 and JA4 fingerprints in: diff --git a/src/content/docs/bots/troubleshooting.mdx b/src/content/docs/bots/troubleshooting.mdx index 319f429523689d..f67698f6b61ed2 100644 --- a/src/content/docs/bots/troubleshooting.mdx +++ b/src/content/docs/bots/troubleshooting.mdx @@ -83,13 +83,9 @@ To allow traffic from good bots, use the [Verified Bot](/ruleset-engine/rules-la --- -## Why might the ja3hash be empty in HTTP logs? +## Why might the ja3hash or JA4 be empty in HTTP logs? -The JA3 Fingerprint can be null or empty in some cases. The most common case is for HTTP requests, because JA3 is calculated in TLS, but can also be empty due to the following: - -- Orange to Orange zones (Cloudflare Zone proxied to another Cloudflare Zone). - -- Worker sending requests within the same zone or to a zone that is not proxied (or a 3rd party). + --- diff --git a/src/content/partials/bots/ja3-fingerprint.mdx b/src/content/partials/bots/ja3-fingerprint.mdx index a8fe96c8eadd1c..66c7dd27fcce57 100644 --- a/src/content/partials/bots/ja3-fingerprint.mdx +++ b/src/content/partials/bots/ja3-fingerprint.mdx @@ -3,4 +3,4 @@ --- -[**JA3**](https://github.com/salesforce/ja3) and [**JA4**](https://github.com/FoxIO-LLC/ja4) **Fingerprints** help you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates. +[**JA3**](https://github.com/salesforce/ja3) and [**JA4**](https://github.com/FoxIO-LLC/ja4) **fingerprints** help you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates. diff --git a/src/content/partials/bots/ja3-ja4-null.mdx b/src/content/partials/bots/ja3-ja4-null.mdx new file mode 100644 index 00000000000000..2add7303524256 --- /dev/null +++ b/src/content/partials/bots/ja3-ja4-null.mdx @@ -0,0 +1,8 @@ +--- +{} + +--- + +The [JA3/JA4 fingerprint](/bots/concepts/ja3-ja4-fingerprint/) can be null or empty in some cases. The most common case is for HTTP requests because JA3 and JA4 are calculated in TLS. It can also be empty due to the Worker sending requests within the same zone or to a zone that is not proxied (or a third party). + +[Orange to Orange (O2O)](/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/) should not cause null or empty JA3 or JA4 fingerprints, unless the eyeball zone is routing traffic to the target zone using a Worker. \ No newline at end of file