Skip to content

Latest commit

 

History

History
17 lines (13 loc) · 1.63 KB

README.md

File metadata and controls

17 lines (13 loc) · 1.63 KB

Tax Authority in UK (HMRC) requires software providers using some of their APIs (Eg: MTD VAT API) to provide consistent headers known as Fraud Prevention headers as part of the request. These are HTTP headers that help HMRC to monitor and audit transactions to protect taxpayers’ data from fraudulent activities. Details here: https://developer.service.hmrc.gov.uk/api-documentation/docs/fraud-prevention

Fraud prevention headers submitted by an application are expected to meet the requirements of HMRC’s fraud prevention specification.

Here are some of HMRC's fraud prevention headers required to be sent by web applications, for which the values can be generated using this library in the format that HMRC expects:

  1. Gov-Client-Timezone (The local timezone of the originating device, expressed as UTC±)
  2. Gov-Client-Screens (Originating device’s screen details like width, height, scaling-factor, colour-depth)
  3. Gov-Client-Window-Size (Originating device’s window width and height)
  4. Gov-Client-Browser-Plugins (A list of browser plugins on the originating device)
  5. Gov-Client-Browser-Do-Not-Track (Indicates whether 'Do Not Track option' is enabled on the browser)
  6. Gov-Client-Local-IPs (A list of all local IPv4 and IPv6 addresses available to the originating device)
  7. Gov-Client-Local-IPs-Timestamp (A timestamp to show when Gov-Client-Local-IPs is collected)
  8. Gov-Client-Browser-JS-User-Agent (JavaScript-reported user agent string from the originating device)

Detailed information about each of these headers can be found here: https://developer.service.hmrc.gov.uk/guides/fraud-prevention/connection-method/web-app-via-server/