<- Back to Index

ETag Tracking

Using browser caching mechanisms to persist tracking identifiers.

Tracking via Cache

ETags (Entity Tags) are an HTTP header designed for web caching. When a browser requests an image, the server sends back the image and an ETag (a hash of the image, e.g., ETag: "12345"). The next time the browser requests that image, it sends If-None-Match: "12345". If the image hasn't changed, the server sends a 304 Not Modified, saving bandwidth.

The Exploit

Trackers abuse this by sending a unique identifier as the ETag. Instead of a hash of the image, the server sends ETag: "USER_ID_8899". The browser obediently stores this. On the next visit, the browser sends If-None-Match: "USER_ID_8899". The server logs the user ID, completely bypassing cookie restrictions.

Mitigation

Because ETags are tied to the browser cache, clearing your cache removes the tracker. Furthermore, modern browsers have implemented cache partitioning. The cache for tracker.com loaded on siteA.com is kept separate from the cache for tracker.com loaded on siteB.com, effectively killing ETag-based cross-site tracking.