Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature Request: Create a programatic way to prevent source collection #1069

Open
issacgerges opened this issue Jan 12, 2025 · 8 comments
Open

Comments

@issacgerges
Copy link

Scenario

  • What's the scenario, what happens and what did you expect to happen?

Through the experimental Crash Reporting API, we've been able to identify that the font source can cause "unresponsive" events. We're currently excluding this data before calling hashComponents, and would like to prevent it from being collected at all.

At the moment it seems one way to do this is to manually delete items off the exported sources field, although its unclear if this is supported/safe.

Alternatively we could patch the package and add an array of excludes here.

Really just curious if this could be supported API

  • What device and browser are you using?
    Chromium

  • What version of FingerprintJS are you using? (Bug reports not applicable to FingerprintJS master are subject to be closed without comment.)
    3.3.3

@Valve
Copy link
Contributor

Valve commented Jan 13, 2025

Thanks for submitting this issue @issacgerges
Can you please provide more information about the "unresponsive" events?
How often do they occur? What browsers/platforms? Under what conditions?
If this is a statistically rare event, we want to prioritize it differently from a major issue

@issacgerges
Copy link
Author

issacgerges commented Jan 13, 2025

unresponsive is a Chromium concept and happens when the following occurs:

A UI event (like a button click) is sent from the main thread to the renderer thread, which isn't acknowledged (or handled) for 15s.

It's most often caused by synchronous javascript running for that long. In Google Chrome it bubbles to the user in a message that looks something like this, other Chromium embedders handle it in different ways

image

A very recent browser api, currently in Origin Trial, adds the ability to collect callstacks when this error happens. So after 15s of an unacknowledged input event, the stack is sampled.

We're trialing this API and it's pointing to the following culprit

// get the default width for the three base fonts
for (let index = 0; index < baseFonts.length; index ) {
defaultWidth[baseFonts[index]] = baseFontsSpans[index].offsetWidth // width for the default font
defaultHeight[baseFonts[index]] = baseFontsSpans[index].offsetHeight // height for the default font
}

Too early to say what percentage of users this is, but I can say this is the highest culprit we've detected. A few things to keep in mind

  • We recalculate fingerprints on a 5m interval, because our app is often used across multiple tabs, if the fingerprint updates in one, we don't want older tabs sending older fingerprints.
  • Browsers are complicated, especially when it comes to scheduling, so its difficult to say that 100% of these are real and this would be true for all apps out there

You likely could improve this by adding a yield back to the browser, but that said, we do not use this part of the fingerprint, and this represents a sizable amount of work for the layout engine. I'd really rather not collect it (an other unused parts) at all.

@Valve
Copy link
Contributor

Valve commented Jan 13, 2025

Thanks!
Please feel free to exclude this source from collection temporarily by patching the collection code, forking the library or any other mechanism that works for you.
I'll mark this as "help_wanted", but cannot provide an ETA about when we'll be to look into this issue.
A reproducible example would greatly accelerate the time to resolution though.

@issacgerges
Copy link
Author

Perfect, do you agree this is a safe place to add these items?

export default function loadBuiltinSources(options: BuiltinSourceOptions): () => Promise<BuiltinComponents> {
return loadSources(sources, options, [])
}

Alternatively could import sources and simply delete items off of it

delete source.fonts

@Valve
Copy link
Contributor

Valve commented Jan 13, 2025

@issacgerges can you please link to this Crash Reporting API? I'm not sure if what I'm finding is what you're using, thanks.

@Valve
Copy link
Contributor

Valve commented Jan 14, 2025

Thanks, we've added this to our internal roadmap tracking tool

@Finesse
Copy link
Member

Finesse commented Jan 15, 2025

The 3rd argument here is the list of entropy sources to exclude. You can modify the FingerprintJS source code to add a source name there, or you can create a load() option provide a value for that argument and create a PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants