I built a Rust reverse proxy that passively fingerprints clients at three layers: JA4 (TLS), Akamai (HTTP/2), and TCP SYN (the last one via eBPF/XDP)

Huginn Proxy is a reverse proxy built on Tokio + Hyper + Rustls + Aya (eBPF/XDP) that passively extracts three fingerprints from every connection and forwards them to the backend as headers — without modifying the client request.

There are two good Go implementations I'm aware of:

• fingerproxy: JA3 + JA4 + Akamai, solid, production-used
• ebpf-web-fingerprint: TCP + TLS via eBPF, but it's a library/demo

I wanted all three techniques combined in one proxy, as a Rust implementation. The tricky part was the TCP SYN fingerprint, by the time your application sees a connection, the SYN packet is already gone. The solution is an XDP eBPF program (written with Aya) that hooks into the kernel's ingress path before the TCP stack, and stores them in a BPF map keyed by source IP. The proxy reads from that map when the connection is accepted.

What I'm looking for
Any use cases I'm missing for the fingerprint headers in the backend?
Feedback, Do you think this is a good idea?
If you find this project useful, consider giving it a ⭐ it helps a lot!