DOCSEARCHbyAlgolia
Submit Docs

Evercookie Documentation

repository·master·Indexed 26 days ago

https://github.com/samyk/evercookie

A JavaScript API for creating highly persistent client identification by redundantly storing data across multiple browser storage mechanisms, including standard cookies, HTML5 storage, plugin-based storage (Flash LSO, Silverlight, Java), and browser-specific protocols.

Tokens
582
Snippets
0
Records
4
Agent score
39%

What's inside Evercookie

  1. Overview of Evercookie

    master

    Evercookie is a JavaScript API designed to create extremely persistent cookies in a browser. It aims to identify clients even after standard cookies, Flash Local Shared Objects (LSOs), and other common storage methods have been removed.

    It achieves persistence by storing data across as many browser storage mechanisms as possible. If data is deleted from one mechanism, Evercookie aggressively re-creates it in all other intact mechanisms. If certain plugins like Flash LSO, Silverlight, or Java are available, it can even propagate cookies between different browsers on the same machine.

  2. Configure Backend Server for Evercookie

    master

    Certain storage mechanisms (such as HTTP ETags, Web cache, and HTML5 Canvas PNG storage) require a backend server to function.

    This repository provides a PHP implementation for the etag, cache, and png backend servers.

    If you require other environments, consider these alternatives:

    • Node.js: Use node-evercookie.
    • Django: Use Django Evercookie.

  3. Caveats and Risks of using Evercookie

    master

    Using Evercookie carries several technical and ethical risks:

    • Performance: Loading Silverlight or Flash can cause slow processes and disk thrashing. On older mobile devices, this may render a site unusable.
    • Network Load: CSS History Knocking can trigger a large number of HTTP requests when a cookie is first set.
    • Ethics/Reputation: Using Evercookie is considered controversial in some circles; consider your audience and reputation.
    • Fragility: Browser vendors actively work to patch the mechanisms Evercookie exploits, meaning current functionality may break in future browser updates.

  4. Supported Browser Storage Mechanisms

    master

    Evercookie utilizes a wide variety of storage mechanisms to ensure persistence. Effectiveness depends on the client browser supporting as many of these as possible:

    • Standard Cookies: HTTP Cookies.
    • Plugin-based: Flash Local Shared Objects (LSOs), Silverlight Isolated Storage, and Java (JNLP PersistenceService or CVE-2013-0422).
    • HTML5 Storage: Session Storage, Local Storage, Global Storage, Database Storage (via SQLite), and IndexedDB.
    • Browser/Protocol-based: CSS History Knocking, HTTP ETags (requires backend), Web cache (requires backend), HSTS Pinning, window.name caching, and Internet Explorer userData storage.
    • Advanced/Canvas: HTML5 Canvas (storing values in RGB data of cached PNG images, requires backend).