Cloudflare

By default Cloudflare forwards a cf-ja4 request header to the origin (JA4 fingerprint). On the nginx side, you just rename cf-ja4 to X-Client-JA4 and unmask can read it.

1. Cloudflare dashboard → select the relevant zone
2. Rules → Transform Rules → Managed Transforms
3. Turn ON the Add visitor location headers or JA4 fingerprint family of toggles
4. cf-ja4 / cf-ja4-signal etc. are automatically added to requests to the origin

Add this to the http {} scope:

# rename the cf-ja4 Cloudflare sends to the X-Client-JA4 that unmask reads.
# if cf-ja4 is empty, the fallback (direct origin access etc.) is an empty string → unmask
# falls back to the native module's self-computed $client_ja4.
map $http_cf_ja4 $http_x_client_ja4_remap {
    default $http_cf_ja4;
}

※ unmask's standard map reads $http_x_client_ja4, so in some cases it is simpler to override it directly in the server scope with set $effective_ja4 $http_cf_ja4;.

AWS ALB / CloudFront

Unfortunately, as of 2025, neither AWS ALB nor CloudFront has a native JA4 extraction feature. There is also no mechanism for putting a template variable into a custom header (the equivalent of GCP's {client_ja4_fingerprint}). A workaround is needed.

Place Cloudflare in front of the AWS ALB and let Cloudflare do the JA4 extraction. The simplest and most production-ready option. See the Cloudflare tab for details.

Bind a Lambda@Edge function to CloudFront to parse the TLS handshake at the viewer request stage → compute the JA4 → inject the header. Implement it per the ja4 spec. Parsing uses the aws-sdk family plus your own implementation.

// Lambda@Edge (Node.js) sketch — viewer request event
exports.handler = async (event) => {
    const req = event.Records[0].cf.request;
    // CloudFront provides req.clientIp and some TLS info, but
    // the full ClientHello bytes do not arrive, so a complete JA4 implementation is hard.
    // Instead, a pragmatic implementation that builds a proxy
    // signature by combining a ja3 hash, clientTLSVersion, etc. is the realistic answer.
    req.headers['x-client-ja4'] = [{ key: 'X-Client-JA4', value: 'placeholder' }];
    return req;
};

Bind an Elastic IP + ACM certificate directly to the EC2 instance and terminate TLS with nginx. nginx can then see the client TLS handshake directly via the unmask native module → it can obtain the complete JA4. However, you lose ALB features (sticky sessions, WAF integration).

Other LBs / Reverse proxies

The recipe is the same as the LBs above: terminate TLS at the front layer, compute the client JA4 there, and forward it to the backend in the X-Client-JA4 header (overriding any client-sent value). Add the front layer's source CIDR under custom LB in the admin Settings → Network tab so unmask trusts the header. Any reverse proxy that can expose the client TLS handshake's JA4 can drive unmask this way.

Switching to unmask's native mode is the easiest (an official module is provided). For install steps, see the native mode section of the install guide.