Skip to content

[Bots] update JA3/JA4 fingerprint documentation #21042

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 21, 2025
Merged

[Bots] update JA3/JA4 fingerprint documentation #21042

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e8ce781
update JA3/JA4 fingerprint documentation
patriciasantaana Mar 21, 2025
a1e38cf
Update src/content/partials/bots/ja3-ja4-null.mdx
patriciasantaana Mar 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/content/docs/bots/concepts/ja3-ja4-fingerprint.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
pcx_content_type: concept
title: JA3/JA4 Fingerprint
title: JA3/JA4 fingerprint

---

Expand Down Expand Up @@ -72,6 +72,8 @@ When JA4 Signals are missing, the output appears as follows:
This sample was generated using [Workers' Cloudflare Object script](/workers/examples/accessing-the-cloudflare-object/).
:::

<Render file="ja3-ja4-null" />

## Analytics

To get more information about potential bot requests, use these JA3 and JA4 fingerprints in:
Expand Down
8 changes: 2 additions & 6 deletions src/content/docs/bots/troubleshooting.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,13 +83,9 @@ To allow traffic from good bots, use the [Verified Bot](/ruleset-engine/rules-la

---

## Why might the ja3hash be empty in HTTP logs?
## Why might the ja3hash or JA4 be empty in HTTP logs?

The JA3 Fingerprint can be null or empty in some cases. The most common case is for HTTP requests, because JA3 is calculated in TLS, but can also be empty due to the following:

- Orange to Orange zones (Cloudflare Zone proxied to another Cloudflare Zone).

- Worker sending requests within the same zone or to a zone that is not proxied (or a 3rd party).
<Render file="ja3-ja4-null" />

---

Expand Down
2 changes: 1 addition & 1 deletion src/content/partials/bots/ja3-fingerprint.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@

---

[**JA3**](https://github.com/salesforce/ja3) and [**JA4**](https://github.com/FoxIO-LLC/ja4) **Fingerprints** help you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates.
[**JA3**](https://github.com/salesforce/ja3) and [**JA4**](https://github.com/FoxIO-LLC/ja4) **fingerprints** help you profile specific SSL/TLS clients across different destination IPs, Ports, and X509 certificates.
8 changes: 8 additions & 0 deletions src/content/partials/bots/ja3-ja4-null.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
---
{}

---

The [JA3/JA4 fingerprint](/bots/concepts/ja3-ja4-fingerprint/) can be null or empty in some cases. The most common case is for HTTP requests because JA3 and JA4 are calculated in TLS. It can also be empty due to the Worker sending requests within the same zone or to a zone that is not proxied (or a 3rd party).

[Orange to Orange (O2O)](/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/) should not cause null or empty JA3 or JA4 fingerprints, unless the eyeball zone is routing traffic to the target zone using a Worker.