php - Which request headers can be used for a browser/client fingerprint? -

for added security our server keeps track of browser fingerprint. @ moment use following headers:

• 'http_client_ip', 'http_x_forwarded_for', 'http_x_forwarded', 'http_x_cluster_client_ip', 'http_forwarded_for', 'http_forwarded', 'remote_addr' (take first non-empty client-ip)
• http_acceptxxxx
• http_user_agent

are there more (optional) headers can used?

what in general best 'algorithm' calculate client fingerprint?

you can use unique browser fingerprint (user agent, web browser, canvas, etc) , after hash.

/* generate fingerprint string browser */ function generatefingerprint(){ //generate string based on "stable" information taken browser //we call here "stable information", information don't   change during user //browse application after authentication var fingerprint = [];  //take plugins for(var = 0; < navigator.plugins.length; i++){    fingerprint.push(navigator.plugins[i].name);    fingerprint.push(navigator.plugins[i].filename);    fingerprint.push(navigator.plugins[i].description);    fingerprint.push(navigator.plugins[i].version); }  //take user agent fingerprint.push(navigator.useragent);  //take screen resolution fingerprint.push(screen.availheight); fingerprint.push(screen.availwidth); fingerprint.push(screen.colordepth); fingerprint.push(screen.height); fingerprint.push(screen.pixeldepth); fingerprint.push(screen.width);  //take graphical card info //see http://output.jsbin.com/ovekor/3/ try {     //add canvas element if body not contains 1     if ( $("#glcanvas").length == 0 ){         $(document.body).append("<canvas id='glcanvas'></canvas>");     }     //get ref on canvas     var canvas = document.getelementbyid("glcanvas");     //retrieve canvas properties     gl = canvas.getcontext("experimental-webgl");     gl.viewportwidth = canvas.width;     gl.viewportheight = canvas.height;     fingerprint.push(gl.getparameter(gl.version));     fingerprint.push(gl.getparameter(gl.shading_language_version));     fingerprint.push(gl.getparameter(gl.vendor));     fingerprint.push(gl.getparameter(gl.renderer));     fingerprint.push(gl.getsupportedextensions().join()); } catch (e) {     //get error because it's stable too..     fingerprint.push(e); }  //last and, in order made browser unique, generate random id store //in local storage (in order persistent after browser close/reopen) //add id because, in enterprise, of time browser have same configuration var browseruniqueid = localstorage.getitem("browseruniqueid"); if (browseruniqueid === null) {   localstorage.setitem("browseruniqueid", cryptojs.lib.wordarray.random(80));   browseruniqueid = localstorage.getitem("browseruniqueid"); } fingerprint.push(browseruniqueid);  return fingerprint.join(); } 

and hash , sent server.

//call fingerprint dedicated function var fingerprint = generatefingerprint(); //use cryptojs library ot generate hex encoded string of hash of fingerprint var fingerprinthash = cryptojs.sha256(fingerprint); 

source: https://www.owasp.org/index.php/json_web_token_(jwt)_cheat_sheet_for_java#token_sidejacking https://browserleaks.com/canvas