---
schema_version: "1"
id: fd13a0f43034e6a11c92c7600ead222e99a8ded204086b6d01ed83ea417511d4
title: Features of the Browser Fingerprint
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_session_features.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_session_features.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 5079fc52752c887a93ff832b6391955c4864d23ce07c9ed59a7ccb2dfe29c8e5
description: A browser fingerprint is a collection of features that together identify a device. Salesforce uses these features to build a model of the user’s original browser fingerprint when they logged in. Salesforce uses this model to detect whether a user’s session was hijacked.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Features of the Browser Fingerprint

A browser fingerprint is a collection of features that together identify a device. Salesforce uses these features to build a model of the user’s original browser fingerprint when they logged in. Salesforce uses this model to detect whether a user’s session was hijacked.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

Features of Session Hijacking   
| Feature Name | Description | Example |
| --- | --- | --- |
| window | The window size, in pixels, of the browser. | (750, 340) |
| userAgent | HTTP Header that contains information about the browser, operating system, version, and more. | `Mozilla/5.0(iPad; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B314 Safari/531.21.10` |
| timestamp | Timestamp of the captured event. Usually in Coordinated Universal Time (UTC) format. | 2020-03-03T03:10:10Z |
| screen | The screen size, in pixels, of the browser. | (1050.0,1680.0) |
| plugins | JavaScript attribute that lists the activated browser plugins. | `Chrome PDF Plugin:Portable Document FormatChrome PDF Viewer` |
| originApp | The origin app of the fingerprint. | Lightning |
| drm | Whether DRM (Digital Rights Management) is enabled. | 0, 1 |
| dnt | JavaScript attribute that indicates whether the user is requesting web sites and advertisers to not track them. | enabled |
| webSockets | Whether the browser used web sockets. | true |
| sessionStorage | Whether the browser used session storage. | true |
| platform | Browser-populated JavaScript attribute regarding the platform the browser is running on (window.navigator.platform). | iPad |
| localStorage | Whether local storage is used, extending beyond the duration of the session. | false |
| ipAddress | The IP address in the request. | 96.43.144.26 or ”Salesforce.com IP” |
| indexDb | Whether an indexed database is enabled for browser storage. | true |
| fonts | A hashed value of a list of browser fonts. | 9wAt8IYAgO= |
| color | The color depth of the browser. | (24.0,24.0) |