Cloudflare Proxy Integration

Fingerprint Cloudflare Integration consists of three fundamental parts:

• Fingerprint infrastructure,
• Cloudflare worker,
• Fingerprint JS agent.

Fingerprint infrastructure creates a Cloudflare Worker that's available on the specific path on your site. The rest of your site is not affected.

Cloudflare worker code is 100% open-source and available on GitHub. Once the Fingerprint JS agent is configured on your site correctly, the worker is responsible for delivering the latest fingerprinting client-side logic as well as proxying identification requests and responses between your site and Fingerprint's APIs.

The benefits of using the Cloudflare Integration

• Significant increase in accuracy in browsers with strict privacy features such as Safari or Firefox.
• Cookies are now recognized as “first-party.” This means they can live longer in the browser and extend the lifetime of visitorIds.
• Ad blockers will not block our Fingerprint JS agent from loading. Attempts to connect to an external URL will be stopped by most ad blockers while attempts to connect to the same site URL will be allowed.
• Ad blockers will not block our identification requests since they are sent to the specific path or subdomain that belongs to the same site.
• Insight and control over the identification requests that can be combined with other Cloudflare features like WAF or Analytics.
• With the Cloudflare Integration, you can manage unlimited subdomains and paths and provide Fingerprint services to all your customers at any scale while benefiting from all the 1st-party integration improvements.
• Cookie security: Cloudflare integration drops all the cookies sent from the origin website. The worker code is open-source so this behavior can be transparently verified and audited.
• Easy to meet compliance and auditing requirements.

Setup

The Cloudflare configuration guide on the Fingerprint dashboard will help you set everything up step by step. You can start the guide when creating an account, or later in the App settings.

🚧

Prerequsities

• Only users with the Owner role assigned can launch the Cloudflare configuration guide in the dashboard.
• Cloudflare Integration makes use of the Cloudflare Workers Custom Routes feature. Therefore, your site needs to be added to Cloudflare and needs to be proxied (not DNS-only) through Cloudflare.

Newly created accounts

During the Install step of the onboarding flow, select Cloudflare.

Existing accounts

Navigate to App Settings, switch to the Integrations tab, and select Cloudflare.

After opening the Cloudflare configuration guide, click Get started.

You will proceed to a form where you need to put the information about your Cloudflare account.

Cloudflare Account ID

The Account ID is required to deploy workers. Go to Cloudflare Workers and copy the Account ID.

Cloudflare API Token

The API Token is required to deploy workers. Go to the API Tokens page, select Create Custom Token, and follow the steps bellow.

• Type "fingerprint.com" in the name field.
• Add Account > Workers Scripts > Edit permission.
• Add Zone > Workers Routes > Edit permission.
• Select the account in the Account Resources.
• Select Specific zone > yourwebsite in the Zone Resources.
• Add IP Filtering > 3.23.16.20.
• Do not set any TTL.

In the next step, see the summary and click Create Token.

📘

API Token Safety

When creating an API Token, it is considered best practice to grant it as few privileges as possible. In the example above, the API Token has permissions to only manage workers in your account. Fingerprint will use your API Token for managing the Fingerprint Cloudflare Worker and nothing else.

Fingerprint always encrypts customer data, including API tokens and configuration items. This guarantees that the data we get from our customers is securely transmitted and stored. The Client IP Address Filtering functionality adds an additional layer of security. Whitelisting our public Cloudflare service IP address ensures that the API Token can only be used by Fingerprint services and no one else.

After entering Account ID and API Token, proceed to the next step.

Select the same domain you had created the API Token for before from the dropdown menu. If you don't see the domain you wish to use, please contact our support at [email protected].

Confirm to start the deployment process. This process may take several minutes.

When you provide the integration wizard with the information above, we will create a Cloudflare Worker in your Cloudflare account. Cloudflare Worker will be named fingerprint-pro-cloudflare-worker-your-website-com, you will be able to see it in Cloudflare Workers Dashboard once it is deployed.

🚧

Do not disrupt worker updates

We are responsible for updating your Cloudflare Worker to ensure visitor identification on your website runs smoothly and keeps up with new browser releases and fingerprinting evasion techniques. Outdated worker configuration can lead to lower accuracy or break visitor identification completely. Don't make any changes that would prevent us from updating your worker:

• Don't reduce the API Token permissions or revoke it.
• Don't change the name of the worker (worker names are used as IDs).
• Don't change the original worker route and configuration.

Fingerprint JS agent configuration

Once the worker is deployed, you need to configure your client-side application accordingly. In this step, you can choose from a variety of frameworks, platforms, and approaches. You can always come back to App settings -> Integrations to find code snippets for different frameworks which reflect your Cloudflare configuration setup.

Using Multiple Worker Routes

Cloudflare Integration uses Cloudflare Workers, which supports multiple routes. You can add more routes if you need to but don't change the original worker route and configuration created by Fingerprint.

Troubleshooting

The Cloudflare integration has limited visibility into your Cloudflare environment. If you run into issues, please verify that one of your existing Firewall rules, rate limiting rules, or other Cloudflare restrictions is not disrupting the Fingerprint worker and its path. Get in touch with our support team if necessary.