Catalogue · Section 07 · Entry
nginx-http2-fingerprint
DEAD
nginx-http2-fingerprint is a C project catalogued in section 07 of this register. Reference implementation of HTTP/2 fingerprinting inside nginx. Read it; do not deploy it. It reads DEAD at the last field check, and it is still listed as live by registries that do not check. The status and the instant it was read at are both printed below.
https://github.com/Xetera/nginx-http2-fingerprint
The fields this state was derived from
| Field | Value at this printing |
|---|---|
| pushed_at | 2021-08-14 |
| archived | false |
| latest_release | — |
| license.spdx_id | null (none declared) |
| stargazers_count | 40 |
| http_status | 200 |
| fetched_at | 2026-08-14T09:12:00Z |
| endpoint | GET https://api.github.com/repos/Xetera/nginx-http2-fingerprint |
| rubric_edition | 2nd, in force since 2026-08-14 |
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why it reads DEAD
pushed_at = 2021-08-14 — 1826 days, past the 1095-day outer threshold.
Unreachable, or untouched past the outer threshold.
Under the superseded first edition
Unchanged: the first edition read DEAD from the same fields.
The rubric in force · The superseded first edition · Errata leaf
What nginx-http2-fingerprint actually does
A reference implementation of HTTP/2 fingerprinting inside nginx, which is valuable as a demonstration of how cheaply the detection side can collect this signal at the edge.
What nginx-http2-fingerprint's maintenance signals mean
pushed_at reads 2021-08-14 — 1826 days, about 5.0 years, past the 1095-day outer threshold. Three years is where this register stops describing a repository as merely quiet.
DEAD in this catalogue is a statement about a measurement, not an obituary. The code is still there and may still compile; what has stopped is anybody attending to it. Read that against what the project is for. A passive fingerprinting reference from a decade ago can be entirely current as a description of a technique while being entirely unmaintained as software, and this register prints the second fact without implying the first.
No release was captured for this entry, which this register records as unknown rather than as none. The distinction matters more than it looks: a project with no tags and a project whose tags the sweep failed to read produce the same blank cell, and printing them as the same fact would be the register asserting something it has not measured.
Where nginx-http2-fingerprint sits in this catalogue
nginx-http2-fingerprint is filed in section 07, network, tls & http fingerprint tooling, whose scope is this: The layer below JavaScript: TLS ClientHello and HTTP/2 fingerprinting, impersonating clients, and the passive tooling that reads them. An entry sits in exactly one section here. Where a project could defensibly go in two, it is placed where a reader would look for it first rather than where it fits most tidily, and that is an editorial decision rather than a measured one.
Filed beside it in the same section: TrackMe (tls.peet.ws) (ACTIVE), rama (ACTIVE), mitmproxy (ACTIVE). Comparing an entry against its own section-mates is more informative than comparing it against the catalogue as a whole, because everything in a section is answering roughly the same question and the differences left over are the ones that matter.
Its licence field is empty, and this register treats that as a finding rather than a gap — see every entry here that declares no licence. Source you can read is not source you have been granted the right to use, modify or redistribute, and an absent licence file means exactly that absence and nothing friendlier. It is also grouped with everything else the rubric marks DEAD.
What to settle before you adopt nginx-http2-fingerprint
Read it; do not deploy it. It has not been touched in years, it carries no licence grant, and it patches a web server that has shipped many security releases since.
Questions readers ask about nginx-http2-fingerprint
Answered from this entry's own fields, at the field check printed above and at no other instant.
Is nginx-http2-fingerprint still maintained?
At the 2026-08-14 field check this register read pushed_at as 2021-08-14 and the archive flag as false, and the rubric in force turned those into DEAD. Unreachable, or untouched past the outer threshold. The clause that fired is printed on this page, so you can check the arithmetic rather than take the word.
What else in this registry does the job nginx-http2-fingerprint does?
No substitution edge is declared for this entry, which means nobody has stated one rather than that none exists. The nearest comparison available is the rest of section 07, where everything is answering roughly the same question on the same printed fields.
What licence is nginx-http2-fingerprint under?
None is declared. That is a finding, not a formatting problem: without a licence file there is no grant to use, modify or redistribute the code, however openly it is published. Every entry here in the same position is listed together for that reason.
Where does this status come from?
From one sweep, recorded with the instant it ran. The raw fields, the endpoint they were read from, the fetch timestamp and the rubric edition in force are all printed on this page, and the same row is in the CC0 data files in JSON and CSV. Recompute the state from those columns and this page must agree with you; where it does not, the register is wrong.
Section 07 is the half of a fingerprint that JavaScript cannot reach, and a browser-shaped page surface over a tool-shaped handshake is a contradiction that no amount of navigator patching fixes. Donut Browser is a real browser rather than an impersonating client, which resolves that layer by not having the problem — and it adds profile-level proxy handling with a launch gate that checks the exit's geography against the profile before anything starts.
curl -fsSL https://donutbrowser.com/install.sh | sh
macOS (DMG, Homebrew cask donut), Windows (installer and portable), Linux (deb, rpm, AppImage, with APT and RPM repositories at repo.donutbrowser.com), and a Nix flake. Desktop only — there is no mobile build target. Ten shipped languages. Source, AGPL-3.0 · its own entry, judged by the same rubric · the keepers' disclosure.