Skip to content

v1.6.5

httpcloak v1.6.5
@sardanioss sardanioss tagged this 30 Apr 18:30 
Build any browser fingerprint from JSON

  describe_preset(name) emits every effective fingerprint field as a
  JSON document. Mutate, load_preset_from_json, register, use. Same
  workflow across Python / Node.js / .NET / Go. Round-trip byte-equal.

Per-resource-type H2 stream priority (Issue #56)

  Chrome 141..147 desktop/android and Firefox 148 now emit a distinct
  RFC 7540 stream weight + RFC 9218 priority: header per
  Sec-Fetch-Dest. Safari and iOS variants stay opted out
  (NoRFC7540Priorities=true). 14-dest default table inherits when a
  preset doesn't define its own.

Caller-supplied headers respect HPACK position

  cache-control / content-type / content-length / origin / referer /
  cookie now land at their real-Chrome HPACK slot instead of being
  appended after the preset's last entry.

Per-request timeout uniformly seconds

  Python Session.get/post/etc, .NET Session.Get/Post/etc, and Node.js
  Session.get/post all accept timeout in seconds, matching
  Session(timeout=). Three coordinated bugs fixed across bindings and
  clib async paths.

Cookie API close-out (BREAKING)

  get_cookies() / getCookies() / GetCookies() now return cookie
  objects with full metadata (List[Cookie] / Cookie[] / List<Cookie>),
  closing the v1.6.1 deprecation cycle. The flat name->value dict
  shape is gone. Same change for the singular get_cookie(name) /
  getCookie(name) / GetCookie(name) -> Cookie object or null.
  Migration: cookies.find(c => c.name == 'foo')?.value or equivalent.

JSON preset loader hardening

  RegisterStrict() rejects (a) name collision with a built-in,
  (b) duplicate custom-name registration, (c) empty name. clib
  loader paths use it. BuildPreset gains an inheritance-loop
  walker (rejects based_on chains that re-enter themselves) and
  early ParseJA3 validation (malformed JA3 errors at load time
  instead of mid-handshake).

http2.akamai shorthand authoritative override

  When a custom preset spec inherits from a built-in AND sets
  http2.akamai to a captured shorthand, the SETTINGS values +
  WINDOW_UPDATE + stream weight + pseudo-order from the shorthand
  now win over inherited discrete fields for the slots the
  shorthand specifies. Previously the discrete zero defaults that
  describe_preset always emits silently clobbered the captured
  shorthand values.

Dependency bump: sardanioss/quic-go v1.2.24

  Picks up the per-connection QUIC transport parameters work
  (a8287c14). Removes the long-standing local-fork replace
  directive that previously made `go install` impossible.

Other notable

  - chrome-148-ios preset + embedded JSON registry
  - Expanded JSON preset spec (key_share_curves,
    delegated_credential_algorithms, QUIC H3 fields)
  - Tweak-fingerprint examples in Python / Node.js / .NET
  - WithDisableHTTP3() session option
  - PresetPool rotation (round-robin / random) in all bindings
  - Issue #57: retry default = 0 (was 3 in Python / Node.js)
  - Issue #52: strip Referer / Authorization on scheme downgrade
    and cross-origin redirects
  - Issue #48: Node.js FFI string leaks fixed via koffi disposable
  - Issue #53: fetch_mode kwarg on every request method
  - Issue #51: .NET cookie Max-Age widened to int64
  - Issue #42: binary response body corruption fixed across all
    bindings via base64 envelope
  - Hybrid-PQ JA3 handshake fix (X25519MLKEM768 first key share)
  - QUIC google_connection_options corrected to ORIG
Assets 2
Loading