XSS-FP: Browser Fingerprinting using HTML Parser Quirks

Who's Breaking the Rules? Studying Conformance to the HTTP Specifications and its Security Impact

“…Due to the same issue, browsers often implement error tolerance where the browsers are trying to accept way more inputs than specified by a grammar or trying to repair invalid values automatically [38]. As a result, various issues such as mutationXSS [39], browser fingerprinting [2], and inconsistent security header behavior between browsers [15] arise.…”

“…However, this project does not support the new RFC 9110 specifications and misses many functionalities, such as HTTP/2 support. The interest in the project also appears low, and we could find, report, and fix a bug in a header ABNF check that has existed for six years 2 .…”