appsec-bot-challenge-detect-form-factor

1name: crowdsecurity/appsec-bot-challenge-detect-form-factor
2# Consistency checks between the platform a visitor claims and the input stack
3# it actually has. Every signal here already exists in the fingerprint, so this
4# config ships no JavaScript and cannot be evaded by blocking it.
5#
6inband:
7  on_challenge_submit:
8    # A phone with a mouse. Real Android and iOS report a coarse pointer and no
9    # hover; a desktop browser wearing a mobile user agent reports neither.
10    - filter: >-
11        (req.UserAgent() contains "Android" || req.UserAgent() contains "iPhone") &&
12        fingerprint.Signals.Device.MediaQueries.Pointer == "fine" &&
13        string(fingerprint.Signals.Device.MediaQueries.Hover) == "true"
14      apply:
15        - AddRequestScore(0, "mobile_desktop_input", "detect-experimental-form-factor")  # intended weight: 100
16
17    # Every browser on iOS is WebKit, so Blink's window.chrome surface cannot
18    # exist there.
19    - filter: 'req.UserAgent() contains "iPhone" && string(fingerprint.Signals.Browser.Features.Chrome) == "true"'
20      apply:
21        - AddRequestScore(0, "ios_blink_surface", "detect-experimental-form-factor")  # intended weight: 100
22
23    # Chrome and Firefox report a colour depth of 24 on every platform they
24    # support. 32 is a value real engines stopped emitting long ago.
25    - filter: 'int(fingerprint.Signals.Device.ScreenResolution.ColorDepth) == 32'
26      apply:
27        - AddRequestScore(0, "color_depth_32", "detect-experimental-form-factor")  # intended weight: 50
28
29    # No pointing device and no hover at all: a headless input stack.
30    # TBD: Test with smart tv with no pointing device and kiosk.
31    - filter: >-
32        !(req.UserAgent() contains "Android" || req.UserAgent() contains "iPhone" ||
33          req.UserAgent() contains "iPad" || req.UserAgent() contains "Mobile") &&
34        fingerprint.Signals.Device.MediaQueries.Pointer == "none" &&
35        string(fingerprint.Signals.Device.MediaQueries.Hover) == "false"
36      apply:
37        - AddRequestScore(0, "no_pointer_desktop", "detect-experimental-form-factor")