Seatext library / BotRefund evidence
When Server-Side WebGL Analysis Beats Client-Side Detection: A Deployment Trade-Off Guide
Server-side WebGL analysis is preferable when tamper resistance matters more than latency — such as forensic audits, refund evidence, or high-value ad protection — because the browser cannot alter the rendered output. Client-side detection...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Server-side WebGL analysis is preferable when tamper resistance matters more than latency — such as forensic audits, refund evidence, or high-value ad protection — because the browser cannot alter the rendered output. Client-side detection wins when you need real-time blocking, sub-100ms decisions, or want to avoid round-trip overhead.
Why the architecture choice matters
WebGL exposes the GPU through the browser. That makes it a powerful fingerprinting surface: renderer strings, extension lists, texture limits, and shader precision all vary by hardware and driver. Bot authors know this. They spoof WebGL constants, inject noise, or run headless browsers with software renderers that mimic real devices. Where you run the analysis determines whether the spoof succeeds.
Client-side scripts execute inside the same JavaScript context the attacker controls. A determined bot can hook getParameter, override getExtension, or replace the entire WebGLRenderingContext prototype before your detection runs. Server-side analysis — whether you stream frames to a headless renderer or ship WebGL calls to a remote GPU — moves the observation point outside the attacker's sandbox. The trade-off is latency, infrastructure cost, and complexity.
How WebGL detection works in each model
Client-side detection
The page loads a small script. It creates a canvas, gets a WebGL context, and reads constants like MAX_TEXTURE_SIZE, UNMASKED_RENDERER_WEBGL, and supported extensions. It may also draw a gradient or a textured triangle and read back pixels with readPixels. The script hashes the results and sends a fingerprint to your backend. BotRefund uses this approach for its WebGL Texture Constraint check, treating the signal as one piece of evidence among 106 independent checks rather than a standalone verdict.
Server-side analysis
Two common patterns exist. In WebGL-to-ASCII or command-stream replay, the client serializes every WebGL call (including shader source, buffer data, and draw commands) and POSTs it to your server. The server replays the stream in a controlled headless environment (e.g., Chrome with SwiftShader or a real GPU) and compares the rendered output to a reference. In rendered-frame analysis, the client captures a frame via toDataURL or readPixels and uploads the image; the server runs perceptual hashing or pixel-diff against known-good renders. Both move the trust boundary to infrastructure you control.
Trade-off table: server-side vs client-side WebGL analysis
| Criterion | Server-side (replay or frame analysis) | Client-side (in-browser script) | Takeaway |
|---|---|---|---|
| Tamper resistance | High — attacker cannot modify the renderer or intercept the replay | Low — prototype hooks, context wrapping, and devtools overrides can falsify every read | Choose server-side when evidence must survive a motivated adversary |
| Latency | 50–300 ms round-trip + replay time; adds to page load or async checkpoint | 1–5 ms in-browser; near-zero perceived delay | Client-side for real-time gating; server-side for async audit |
| Infrastructure cost | GPU instances or headless fleet; scales with traffic volume | Static JS bundle; CDN cost only | Client-side cheaper at high volume; server-side justified for high-value traffic |
| Coverage of headless / cloud browsers | Detects software renderers (SwiftShader, llvmpipe) via timing and pixel diff | Relies on constant spoofing; often misses sophisticated emulation | Server-side catches more advanced bots |
| Privacy / compliance | Uploads frame data or command streams; may be considered biometric in some jurisdictions | Hashes stay in browser; only fingerprint leaves device | Client-side simpler for GDPR/CCPA; server-side needs DPIA |
| Implementation effort | Custom replay engine, headless fleet, diff logic, fallback handling | Few KB of JS; well-documented WebGL constants | Client-side ships in hours; server-side takes weeks |
| False-positive profile | Legitimate users on rare GPUs or corporate VDI may diff against reference set | Privacy tools (CanvasBlocker, Chameleon) cause constant mismatches | Both need cross-checking; BotRefund treats each signal as evidence, not verdict |
Decision framework: a readiness checklist
Use this checklist before committing to server-side WebGL analysis. If you answer "yes" to most items, the investment pays off.
- You protect ad spend above $50K/month where refund evidence must withstand platform review.
- You have seen sophisticated bots that spoof
WEBGL_debug_renderer_infoand pass client-side checks. - Your team can operate a headless Chrome fleet (or contract a vendor) with GPU access.
- You can tolerate 100–300 ms async latency for the detection checkpoint.
- You have legal review for frame-upload privacy implications.
- You already cross-check WebGL signals against behavior, network, and device data — so a single anomaly never auto-blocks.
If you answer "no" to three or more, start with client-side detection and a strong cross-checking layer. BotRefund's approach — keeping WebGL Texture Constraint as independent evidence fed into an AI model that weighs the complete pattern — works well for most teams without server-side replay infrastructure.
Practical scenarios
Scenario A: High-value lead-gen campaigns (finance, legal, B2B SaaS)
CPCs exceed $50. Competitors run click-fraud rings using residential proxies and headless Chrome with spoofed WebGL. You need forensic evidence Google and Meta reps accept. Server-side frame analysis gives you pixel-perfect proof that the renderer behaved like SwiftShader, not a real GPU. The latency is acceptable because the checkpoint runs after form submission, not on landing.
Scenario B: Real-time bid shading / traffic shaping
You adjust bids per impression based on bot probability. Decision must complete inside the RTB timeout (often <100 ms). Client-side WebGL hash + behavioral signals (mouse tremor, click timing) feed a lightweight model in the browser. Server-side replay would miss the window.
Scenario C: Compliance-first environments (healthcare, government)
Uploading rendered frames triggers biometric-data review. Client-side hashing keeps raw pixels on device. You accept higher spoof risk in exchange for simpler DPIA. Cross-check with network and behavioral signals compensates.
Limitations and when this advice does not apply
- Mobile app traffic: WebGL runs in WebViews; server-side replay of native WebView calls is rarely practical. Use client-side with attestation (Play Integrity, App Attest).
- Low-volume sites (<10K visits/mo): Infrastructure cost per detection dwarfs fraud loss. Client-side + IP reputation suffices.
- Pure brand-awareness campaigns: No conversion pixel to poison; invalid clicks waste budget but don't corrupt optimization. Platform filters + client-side is enough.
- Teams without DevOps capacity: Running a headless GPU fleet requires monitoring, driver updates, and fallback logic. Vendor solutions (e.g., BotRefund's managed detection) shift this burden.
Key facts from BotRefund's detection architecture
| Fact | Detail |
|---|---|
| WebGL Texture Constraint role | One of 106 independent checks; adds objective evidence about the visit |
| Signal handling | Kept as evidence — not a verdict — and cross-checked against browser, network, device, and behavior data |
| AI prediction model | Weighs the complete pattern across all signals; achieves 99% accuracy through corroboration |
| Single-anomaly policy | Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people |
| Deployment | Client-side script; typical setup time about one minute |
FAQ
Can I run server-side WebGL analysis without GPUs?
Yes — SwiftShader (CPU software rasterizer) works for replay, but it introduces its own fingerprint. Bots running on SwiftShader will match your replay environment, creating false negatives. A heterogeneous fleet (some real GPU, some SwiftShader) with diff logic against both references mitigates this.
Does client-side WebGL detection work on iOS Safari?
Yes. WebGL 1 and 2 are supported. The constant set is smaller (no WEBGL_debug_renderer_info on iOS), so you rely on texture limits, shading language version, and rendered output. BotRefund's client-side check runs on iOS.
What latency budget should I allocate for server-side replay?
Plan for 150 ms median, 400 ms p95 including network, queue, replay, and diff. If your checkpoint must return inside a 200 ms SLA, run it asynchronously and use the result for post-session audit, not real-time block.
How do I handle users behind corporate VDI or cloud gaming?
These environments often use virtual GPUs (vGPU, GRID) that produce consistent but non-consumer renderer strings. Maintain an allowlist of known VDI fingerprints or treat the WebGL signal as low-weight evidence for those IP ranges. Cross-check with behavioral signals (mouse tremor, scroll variance) which remain human.
Is WebGL fingerprinting considered personal data under GDPR?
Hashes of rendered output can uniquely identify a device over time. The EDPB treats persistent device fingerprints as personal data. Client-side hashing with short retention (session-only) and no linkage to PII reduces risk. Server-side frame upload almost certainly requires a DPIA and lawful basis.
Can I combine both approaches?
Yes. Run client-side WebGL hash on every pageview for real-time scoring. For sessions that score above a risk threshold, trigger an async server-side frame capture and replay. This hybrid gives you low-latency gating plus tamper-resistant evidence for refund claims.
What's the minimum traffic volume to justify server-side infrastructure?
Roughly 500K pageviews/month if you build in-house (one GPU instance + headless fleet). Below that, a managed service (BotRefund, or a specialized fraud vendor) spreads the fixed cost across customers.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund can help
BotRefund runs the WebGL Texture Constraint check client-side as one of 106 independent signals. Each signal feeds an AI model that weighs the complete pattern — browser, network, device, and behavior — instead of trusting a single rule. This cross-checked approach reaches 99% accuracy without requiring you to operate a headless GPU fleet. Setup takes about one minute: add the script, start the free audit, and review the evidence dashboard. If you later need server-side replay for forensic refund cases, the same evidence package is accepted by Google and Meta reps.