Conversation

Antoine Vastel

@xopek59

New techniques to detect Chrome headless: antoinevastel.github.io/bot%20detectio

3:11 PM · Jan 17, 2018Twitter Web Client

Replying to

FYI, the screen resolution test doesn't work on Chrome on MacOS if you have set the dock to hide and show automatically. Might be same for taskbar on Windows.

Replying to

Thanks for the remark , I'll correct it.

Replying to

Great work. Did you try the permissions check on headless Firefox?

Replying to

Thanks. No I only tried Chrome headless for the moment.

Replying to

nice post but they seem to be trivial. couldn't you just spoof some of the variables and functions on the headless driver script? inject some js code into the driver?

Replying to

Thanks. Since fingerprints are collected on client side of course you can spoof/forge the different attributes. However, it enables to detect browsers that just change their UA.

Show replies

Replying to

Interesting! I'm curious why one would need to detect chrome headless? What are some use-cases where that's necessary?

Replying to

To block non human traffic for example

Replying to

Worth noting that `navigator.webdriver` can be a false positive. e.g. run headlful Chrome with `--enable-automation` and `navigator.webdriver === true`.