Liferay: add cookie + HTML signals for response-first detection - #351
Liferay: add cookie + HTML signals for response-first detection#351danielserranoh wants to merge 1 commit into
Conversation
Liferay currently matches only the Liferay-Portal response header and the window.Liferay JS global. Hardened / CDN-fronted installs strip the Liferay-Portal header, and response-first (non-headless) analysis can't observe window.Liferay, so Liferay goes undetected despite unmistakable static markers. Add unique static signals (keeping header/JS + version): - html: Liferay JS API namespaces (Liferay.Util/Language/ThemeDisplay/AUI) and the Liferay portlet DOM id prefix (id="_com_liferay_). - cookies: GUEST_LANGUAGE_ID; COOKIE_SUPPORT at confidence:50 (generic name). Verified on a real hardened install (www.javeriana.edu.co): no Liferay-Portal header, but Liferay.AUI x19, id="_com_liferay_ x519, and a COOKIE_SUPPORT cookie.
|
Closing this one. Per the discussion in #352: One note in case it's ever useful: the Thanks for the review. |
Liferay matches only the
Liferay-Portalresponse header and thewindow.LiferayJS global. Hardened / CDN-fronted installs strip theLiferay-Portalheader, and response-first (non-headless) analysis can't observewindow.Liferay, so Liferay goes undetected despite unmistakable static markers.This adds unique static signals (keeping the existing header/JS matches and version capture):
Liferay\.(?:Util|Language|ThemeDisplay|AUI)(Liferay client JS API namespaces) andid="_com_liferay_(portlet DOM id prefix).GUEST_LANGUAGE_ID;COOKIE_SUPPORTatconfidence:50(generic name, not standalone).Test websites:
Assisted by Claude Code.