Skip to content

v1.6.6

httpcloak v1.6.6
@sardanioss sardanioss tagged this 09 May 15:07 
chrome-148 desktop + android presets

  Adds chrome-148-windows / chrome-148-linux / chrome-148-macos /
  chrome-148-android. Wire-level diff vs chrome-147 is just two
  header values (User-Agent version bump + sec-ch-ua brand list
  rotation). TLS extension shuffle continues per-handshake the
  same way utls already produces; JA4 stays
  t13d1516h2_8daaf6152771_d8a2da3f94cd. chrome-latest aliases
  (and platform-specific chrome-latest-* + android-chrome-latest)
  now resolve to 148. iOS already at 148 from v1.6.5.

WithoutCookieJar() across all 4 bindings

  New SessionOption that disables the internal cookie jar
  entirely — Set-Cookie headers from responses are not stored,
  the jar is not consulted to inject Cookie: headers on
  subsequent requests. Caller-provided Cookie: headers always
  pass through. Useful when an application maintains its own
  cookie store (database, shared cache across sessions) and
  wants the lib to be byte-transparent about cookies.

  - Go: httpcloak.WithoutCookieJar()
  - Python: without_cookie_jar=True
  - Node.js: withoutCookieJar: true
  - .NET: withoutCookieJar: true

  Guards both Request and RequestStream paths in the session
  layer. Design originally proposed in andreacanes/httpcloak
  (based on gkopp13's patch); implementation expanded to cover
  Set-Cookie storage paths in addition to the inject-on-request
  path.

WithLocalAddrIP(net.IP) ergonomic alias

  Drop-in net.IP-typed sibling for WithLocalAddress(string).
  Lets callers who already hold a parsed IP skip the String()
  round-trip. Same internal storage, nil net.IP is a no-op so
  conditional option chains don't accidentally clobber a
  previously-set address.

Other notable

  - HTTP/3 PRIORITY_UPDATE on the control stream now uses the
    actual request stream ID (was hardcoded 0 — silently dropped
    by H3 fingerprinters because real Chrome never references
    stream 0) and the priority field value derived from the
    request's "priority:" header (was hardcoded "u=0, i" — only
    matched Chrome for document navigations). Visible |984832|
    token now appears in h3_text matching real Chrome 147+
    captures byte-for-byte. Lives in sardanioss/quic-go v1.2.25.
  - client.Client.DoStream cookie jar parity with Do — the
    lower-level Go client API now applies jar cookies before
    streaming requests AND stores Set-Cookie from streamed
    responses. Session-level RequestStream and all language
    bindings already had parity; this only mattered for Go users
    on the lower-level client.Client API. Resolves the GH issue
    asking specifically about Client.DoStream coverage.
  - IP_FREEBIND sockopt actually wired now when WithLocalAddress
    is set. The doc comment had been claiming "Works with
    IP_FREEBIND on Linux" since v1.5.x; now the kernel actually
    sees IP_FREEBIND=15 / IPV6_FREEBIND=78 set on every TCP dial
    socket and UDP listen socket — without it, binding to a
    routed-but-not-locally-configured IPv6 from a /48 prefix
    silently failed with EADDRNOTAVAIL.
  - @httpcloak/win32-arm64 dropped from npm optionalDependencies.
    The package was never built by CI (matrix is linux-x64,
    linux-arm64, darwin-x64, darwin-arm64, win32-x64) so npm
    install on yarn classic / pnpm strict modes errored out at
    install time. Fixed: only advertise platforms we actually
    publish. Re-add when CI gets an aarch64-w64-mingw32-gcc
    cross-compiler step.
Assets 2
Loading