v0.1.0

First release of ja4-guard — the defensive counterpart to impersonate-http.

Peek the inbound TLS ClientHello before the handshake, compute the client's JA4 (and JA4H from the HTTP/1.x request head), and apply an allow / deny / log-only policy — as net/http middleware or a standalone reverse proxy.

What's in it

• ja4/ — clean-room JA4 + JA4H implementation from the public FoxIO spec, ClientHello parser, GREASE handling. No dependencies.
• guard/ — TLS-peeking listener, policy engine (allow-list / deny-list / known-clients / known-browsers, log-only, fail-open/closed), net/http middleware.
• cmd/ja4-guard/ — reverse proxy that enforces the policy in front of an upstream and forwards X-JA4 / X-JA4H.

Verification (every value from a real run)

• curl's captured ClientHello computes to t13d3113h2_e8f1e7e78f70_ce5650b735ce — the exact JA4 tls.peet.ws reports for the same curl.
• Reproduces the FoxIO spec's worked example t13d1516h2_8daaf6152771_e5627efa2ab1, including both sub-hashes.
• Live Chromium capture yields the spec-documented t13d1516h2_8daaf6152771_... prefix and cipher hash.
• JA4H reproduces values from the FoxIO reference ja4h.py.
• go build / vet / gofmt / test -race all green (CI included).

Honest threat model

Catches lazy / honest bots (curl, wget, python-requests/urllib, Go net/http, scrapers with default TLS stacks, UA↔fingerprint mismatches). It does not stop a determined adversary who spoofs a browser JA4 — our own impersonate-http can do that. Use it as a cheap first filter, not as authentication.

MIT licensed. JA4 was created by FoxIO; this is an independent reimplementation of the public spec.