RQ4: Request Context Fingerprinting

Detect browser-impersonating bots by analyzing whether HTTP headers are logically consistent with real browser behavior.

RQ4 is an open standard for fingerprinting HTTP clients based on request context validity. It produces a 4-character fingerprint (vvvv, xvvx, ----) indicating whether the request's headers could have been generated by a real browser.

Why

Modern bot tooling can perfectly replicate browser TLS fingerprints (defeating JA3/JA4) and copy browser header sets (defeating JA4H). But these tools set headers statically — the same navigation headers on every request regardless of context. Real browsers are state machines that generate different headers for page loads vs. API calls, GET vs. POST, user-initiated vs. programmatic requests.

RQ4 catches this architectural gap. Zero client-side JavaScript required.

Quick Start

import { computeRQ4, rq4FromRequest } from './src/rq4';

// From a standard Request object
const input = rq4FromRequest(request);
const result = computeRQ4(input);

console.log(result.fingerprint); // "xvvx" — Mode and Transfer dimensions impossible
console.log(result.dimensions.mode.signals); // ["navigate_dest_empty"]

The Four Dimensions

Code	Dimension	What it checks
M	Mode	Is Sec-Fetch-Mode × Sec-Fetch-Dest valid per the Fetch spec?
U	Upgrade	Are Upgrade-Insecure-Requests and Sec-Fetch-User only on navigations?
I	Identity	Are Sec-CH-UA-* Client Hints consistent with User-Agent?
T	Transfer	Are Content-Type, Accept, body presence consistent with request context?

Each dimension returns v (valid), x (impossible), or - (indeterminate).

Results

Real browsers: Zero false positives across Chrome, Firefox, Safari, Edge on Windows, macOS, Android, iOS.

Browser impersonation tools (default config): Detected — xvvx or xxvx.

Non-browser clients (curl, Python requests): ---- — indeterminate, not flagged.

RQ4-S: Session-Level Extension (v2.0)

RQ4-S correlates per-request RQ4 across a cookie session to catch the cookie-reuse attack — where a real browser solves a WAF challenge (Imperva reese84, Cloudflare Turnstile, F5 Shape, DataDome) and the resulting session cookies are transferred to an HTTP client (curl_cffi, etc.) for fast automated requests.

Per-request RQ4 detects bot requests in isolation. RQ4-S detects the precise moment a session was hijacked — catching the handoff on the first bot request after cookie transfer, with zero false positives across all tested scenarios (Chrome, Firefox, Safari, Edge, WebView, Service Workers, native apps, header-stripping extensions).

import { computeRQ4, rq4FromRequest } from './src/rq4';
import { trackSession, getSessionId, CloudflareKVStore } from './src/rq4s';

const rq4 = computeRQ4(rq4FromRequest(request));
const sessionId = getSessionId(request.headers.get('cookie') ?? undefined);
if (sessionId) {
  const store = new CloudflareKVStore(env.RQ4S_SESSIONS);
  const verdict = await trackSession(store, sessionId, rq4);
  if (verdict.state === 'transition' || verdict.state === 'compromised') {
    return new Response('Forbidden', { status: 403 });
  }
}

Validated, bidirectionally:

• Detection (April 2026): Caught a curl_cffi cookie-handoff on the first bot request against a production Imperva Incapsula reese84 deployment. Imperva did not flag the same handoff.
• Evasion model (June 2026): The context-aware HTTP client architecture identified in SPEC §6.6 as the only effective RQ4-S bypass was independently observed defeating top-tier commercial within-session bot detection in production testing. The spec's symmetric prediction held — what defeats RQ4-S defeats top-tier commercial equivalents implementing the same signal class.

Relationship to commercial WAFs: Within-session behavioral scoring exists in closed-source products (e.g., DataDome's Agent Trust). RQ4-S formalizes one specific signal — RQ4 fingerprint transitions across a cookie session — as an open standard any deployment can implement without commercial licensing. Same relationship JA3 has to closed-source TLS-fingerprint products.

See SPEC.md §6 for the full specification, empirical results, and evasion analysis.

Auxiliary Signals

Optional checks that layer on additional signal without affecting the core fingerprint or its zero-false-positive guarantee:

• Encoding Coherence (encodingCoherence) — checks a client's advertised Accept-Encoding against the Chromium version it claims (Chrome enabled zstd by default in v123). Catches unsophisticated impersonation, e.g. a browser User-Agent on a plain HTTP client; the inverse case (an old-version claim advertising zstd) has no known false positives. Being a static-header check, it is evaded by tooling that keeps Accept-Encoding current. See SPEC.md Appendix A.

Live Demo

Check your own fingerprint: https://rq4.dev

Specification

Read the full spec: SPEC.md

Platform Support

RQ4 runs on any platform with access to HTTP headers:

• Cloudflare Workers
• Nginx (ngx_lua / njs)
• Express / Node.js
• Vercel Edge Middleware
• AWS CloudFront (Lambda@Edge)

License

• Implementation: MIT
• Specification: CC BY 4.0

Citation

RQ4: Request Context Fingerprinting. Version 2.0, June 2026.
AZ. https://rq4.dev