Merge pull request #173 from s-spindler/clarify-header-count

Clarify header count in JA4H

python/ja4h.py

@@ -24,14 +24,14 @@ def to_ja4h(x, debug_stream=-1):
     unsorted_cookie_values = []
 
     x['headers'] = [ h.split(':')[0] for h in x['headers'] ]
-    x['headers'] = [ h for h in x['headers'] 
-            if not h.startswith(':') and not h.lower().startswith('cookie') 
+    x['headers'] = [ h for h in x['headers']
+            if not h.startswith(':') and not h.lower().startswith('cookie')
             and h.lower() != 'referer' and h ]
 
     raw_headers = x['headers'][:]
 
     #x['headers'] = [ '-'.join([ y.capitalize() for y in h.split('-')]) for h in x['headers'] ]
-    header_len = '{:02d}'.format(len(x['headers']))
+    header_len = '{:02d}'.format(min(len(x['headers']), 99))
 
     if 'cookies' in x:
         if isinstance(x['cookies'], list):

technical_details/JA4H.md

@@ -0,0 +1,9 @@
+# JA4H: HTTP Client Fingerprint
+
+![JA4H](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4H.png)
+
+JA4H fingerprints the HTTP client based on each HTTP request.
+
+### Number of Headers:
+2 digit number of headers, not counting Cookie and Referer. For 3 headers the value is "03".
+If there are more than 99, the output is 99.