Skip to content

Liferay: add cookie + HTML signals for response-first detection - #351

Closed
danielserranoh wants to merge 1 commit into
HTTPArchive:mainfrom
danielserranoh:liferay-response-first-signals
Closed

Liferay: add cookie + HTML signals for response-first detection#351
danielserranoh wants to merge 1 commit into
HTTPArchive:mainfrom
danielserranoh:liferay-response-first-signals

Conversation

@danielserranoh

Copy link
Copy Markdown

Liferay matches only the Liferay-Portal response header and the window.Liferay JS global. Hardened / CDN-fronted installs strip the Liferay-Portal header, and response-first (non-headless) analysis can't observe window.Liferay, so Liferay goes undetected despite unmistakable static markers.

This adds unique static signals (keeping the existing header/JS matches and version capture):

  • html: Liferay\.(?:Util|Language|ThemeDisplay|AUI) (Liferay client JS API namespaces) and id="_com_liferay_ (portlet DOM id prefix).
  • cookies: GUEST_LANGUAGE_ID; COOKIE_SUPPORT at confidence:50 (generic name, not standalone).

Test websites:

Assisted by Claude Code.

Liferay currently matches only the Liferay-Portal response header and the
window.Liferay JS global. Hardened / CDN-fronted installs strip the
Liferay-Portal header, and response-first (non-headless) analysis can't observe
window.Liferay, so Liferay goes undetected despite unmistakable static markers.

Add unique static signals (keeping header/JS + version):
- html: Liferay JS API namespaces (Liferay.Util/Language/ThemeDisplay/AUI) and
  the Liferay portlet DOM id prefix (id="_com_liferay_).
- cookies: GUEST_LANGUAGE_ID; COOKIE_SUPPORT at confidence:50 (generic name).

Verified on a real hardened install (www.javeriana.edu.co): no Liferay-Portal
header, but Liferay.AUI x19, id="_com_liferay_ x519, and a COOKIE_SUPPORT cookie.
@danielserranoh

Copy link
Copy Markdown
Author

Closing this one. Per the discussion in #352: html is deprecated and slower, and HTTP Archive runs Wappalyzer with DOM detection — where the existing Liferay-Portal header and window.Liferay matches already fire. My motivation was response-first detection in an internal engine that can't evaluate dom, which is out of scope here, so I'll carry these signals locally instead.

One note in case it's ever useful: the cookies half of this PR (GUEST_LANGUAGE_ID, plus COOKIE_SUPPORT at lower confidence) isn't affected by the html concern and does help on hardened/CDN-fronted installs that strip the Liferay-Portal header — javeriana.edu.co is one. Happy to open a cookies-only PR if that's of interest; otherwise no need to reopen.

Thanks for the review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant