An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side.

There is an interesting side effect to this technology; ETAGs are saved on a machine even if cookies are deleted. Some people / software have exploited this fact to make an ETAG "act" like a cookie.

This means that simply deleting cookies isn't enough. One has to delete the entire web cache as well. That is a painful process to go through every time I surf the net on my test machine.


What is the most reliable way to prevent tracking that occurs by ETAG headers?


6 Answers 6


I don’t know of any great solutions. I can suggest three possible defenses, though all of them have limitations:

  • Privoxy. Privoxy can block ETag headers.

    In particular, you can use crunch-server-header or server-header-filter in your Privoxy configuration to block ETag: headers from the server. Also, you can use crunch-client-header or client-header-filter in your Privoxy configuration to block If-None-Match: and If-Modified-Since: headers from the client. However, I don’t know of any off-the-shelf formula you can just grab and use: you’d have to build your own Privoxy configuration yourself.

  • Your browser. If you use Firefox, you can configure Firefox to clear your cache each time you exit the browser. This may be bad for performance. Also, with this approach, ETags can still be used to track you within any one browser session, so it is not perfect, but it should clear any ETag cookie when you quit your browser.

  • RequestPolicy. If you use Firefox, you could use the RequestPolicy extension. One writer has pointed out that RequestPolicy may help defend against ETag tracking. Often, web sites track you by including resources from third-party advertisers or analytics providers. RequestPolicy lets you control what third-party resources your browser will request, when visiting a web page, and thus can let you protect yourself against that kind of tracking: if your browser never loads the third-party advertiser’s resource, then the third-party advertiser doesn’t have a chance to track you (using an ETag or any other mechanism). This defense is less than ideal, because it requires you to laboriously assemble your policy, and because web sites can still track you directly if they don’t rely upon any third-party resources.

Unfortunately, if you access the web through a transparent proxy, the presence of the proxy may complicate your attempts to avoid being tracked.

  • also Proxomitron supposedly can filter out or block e-tags.
    – user18238
    Dec 31, 2012 at 21:58

In addition to the more involved solutions proposed by @D.W., you can consider using your browser's private browsing mode, ala InPrivate (IE), PrivateBrowsing (FF), Incognito (Chrome), etc.
The main thing here is that the browser cache is not used (or at least, not used beyond the length of the private session). As such the Etag is not saved by your browser.

There are still some drawbacks to this approach, such as tracking within the session, and proxies as @D.W. mentioned. That said, it is pretty simple to use.


If you're using Firefox, you might be interested in an (optional) feature of my SecretAgent add on... which creates spoof ETag headers to suppress tracking.

The downside is that spoofing ETags will obviously impair caching on those sites which use ETags to optimise traffic (though this seems to have very minor impact on performance).

See www.secretagent.org.uk.

  (Disclaimer: I am the author of SecretAgent).

  • Hi Peter - welcome. Sounds interesting - do you have a link? and thanks for listing your affiliation.
    – Rory Alsop
    Apr 12, 2013 at 13:39

update: wrote the answer differently and more clearly

I have a solution which works without modifying the current HTTP protocol. I'd love to see an implementation of this.

Instead of telling the server our Etag we ASK the server about its Etag, and we compare it to the one we already have.

Pseudo code:

If (file_not_in_cache)

    //Instead of saying "my etag is xyz",
    //the client says: what is YOUR etag, server?"

    if (server_etag==client_etag)

HTTP conversation example with solution 1:


HEAD /posts/46328
host: security.stackexchange.com


HTTP/1.1 200 OK
Date: Mon, 23 May 2005 22:38:34 GMT
Server: Apache/ (Unix) (Red-Hat/Linux)
Last-Modified: Wed, 08 Jan 2003 23:11:55 GMT
Content-Type: text/html
Content-Length: 131

Case 1, Client has an identical etag:

Connection closes, client loads page from cache.

Case 2, client has a mismatching etag:

GET...... //and a normal http conversation begins.

Edit: It is worth noting that there is a minor overhead, the server has to send the HTTP header twice: Once in response to the HEAD, and once in response to the GET. One theoretical workaround for this is modifying the HTTP protocol and adding a new method which requests header-less content. Then the client would request the HEAD only, and then the content only, if the etags mismatch.

Edit 2: I've followed makerofthings7's advice and posted this as a question on stackoverflow.

  • Perhaps post this as a question asking if this is a viable workaround for the HTTP ETAG security / privacy flaw Dec 2, 2013 at 17:50
  • Why would I post this as a question? It is viable and practical. Everything is already implemented in HTTP (The HEAD and GET). Dec 2, 2013 at 18:11
  • It's a great idea, but having it buried as an answer to my question may not get the visibility it deserves Dec 2, 2013 at 18:22
  • Thank you, I will do so. Is copying almost the exact content into a new question okay with Stackexchange rules? Dec 2, 2013 at 18:23
  • 1
    It's best on StackOverflow: "Will this protect me from etag tracking, and will it work with existing ETAG implementations" ... since its possible a weak and strong ETAG implementations may have different results. ... but try StackOverflow.com first, and perhaps link to this question via the share button so you can get "referrer" points. Dec 2, 2013 at 18:28

A future solution could be a browser preference that disables etags.

For Mozilla the issue is discussed in: ETag: filtering to counter web tracking.


Some technical details and a proof of concept demo of ETag tracking: http://ochronus.com/tracking-without-cookies/

  • 3
    Most of this was copied from lucb1e.com/rp/cookielesscookies (legally because it's WTFPL, but it's still mostly just a copy). Also it's recommended to include more details in an answer than merely a link, and you should disclose any affiliation with any website (if applicable).
    – Luc
    Aug 21, 2013 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .