question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

`x-client-data` header should not be sent in requests

See original GitHub issue

Test plan

  1. Visit youtube.com and open a video
  2. Open browser dev tools
  3. Go to network tab
  4. Reload page
  5. Inspect the original request and look for headers. You should NOT see an x-client-data header. Prior versions (and versions without this fix) will be sending the header

Updated Issue Description (notes from @bsclifton)

Visiting sites like youtube.com will show a x-client-data header. This wasn’t in Brave for a long time because we didn’t use the variations server. This showed itself recently since we did recently create a Brave-specific variations server. This header should be disabled.

Original Issue Description

There is an ongoing conversation about the Chrome/Chromium x-client-data header here https://github.com/bromite/bromite/issues/480 and here https://github.com/w3ctag/design-reviews/issues/467#issuecomment-581944600

Does Brave Desktop/Android send a unique client ID (x-client-data) to Google properties (google.com etc)? This is considered a “backdoor” for Google (and google only!) to track users even without cookies.

If Brave sends this header - can it be removed?
If Brave doesn’t send this header - maybe worth mentioning in some privacy features list?

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Comments:15 (6 by maintainers)

github_iconTop GitHub Comments

2reactions
iefremovcommented, Feb 8, 2021

@bsclifton Yeah I think this our variations service. We need to explicitly disable this header

1reaction
GeetaSarvadnyacommented, Feb 17, 2021

Verification passed on


Brave | 1.20.104 Chromium: 88.0.4324.152 (Official Build) (64-bit)
-- | --
Revision | 6579930fc53b4dc589c042bec9d0a3778326974d-refs/branch-heads/4324@{#2106}
OS | Windows 10 OS Version 2004 (Build 19041.804)

  • Verified the STR from the description
1.20.103 1.20.104
image image

Verification passed on

Brave 1.20.104 Chromium: 88.0.4324.152 (Official Build) (64-bit)
Revision 6579930fc53b4dc589c042bec9d0a3778326974d-refs/branch-heads/4324@{#2106}
OS Ubuntu 18.04 LTS
  • Verified the STR from the description

image

Verified FIXED on

Brave 1.20.104 Chromium: 88.0.4324.152 (Official Build) (x86_64)
Revision 6579930fc53b4dc589c042bec9d0a3778326974d-refs/branch-heads/4324@{#2106}
OS macOS Version 11.2.1 (Build 20D74)

using the STR from the description; no x-client-data header was sent.

Screen Shot 2021-02-17 at 10 15 23
Read more comments on GitHub >

github_iconTop Results From Across the Web

Google denies tracking allegation, explains 'X-Client-Data'
The tech community has raised concerns over Google Chrome sending an alleged tracking ID, 'X-Client-Data' to Google servers.
Read more >
Google Backpedals on Claim that X-Client-Data Doesn't ...
Google backpedals on a previous denial that Chrome's X-Client-Data header does not contain personally identifiable (PI) information.
Read more >
Google: You know we said that Chrome tracker contained no ...
Last month, Google's paper said, "This Chrome-Variations header ( X-client-data ) will not contain any personally identifiable information, ...
Read more >
The value of x-client-data is personal data, because it is ...
The x-client-data header is exactly that. The subject of the header is not identifiable by the x-client-data header alone.
Read more >
What is the HTTP_X_CLIENT_DATA in the $_SERVER array?
It's a header with a unique identifier which signifies your specific chrome profile on your specific chrome installation. Google says they ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found