X-Adblock-Key
The HTTP X-Adblock-Key response header is an unofficial header carrying an Adblock Plus sitekey, a public key and per-request signature that let filter lists match a document by its key instead of its URL.
Note
The "X-" naming convention for HTTP headers, "X" referring to "experimental", has been deprecated and needs to be transitioned to the formal naming convention for HTTP headers.
Usage
Adblock Plus filters normally match documents by URL. The
$sitekey filter option matches by public key instead, which
covers cases where URL-based matching is impractical, such as
domain-parking services serving many unrelated domains. The
Acceptable Ads exception list relies on $sitekey entries for
such services. The site embeds its public key and a signature in
the X-Adblock-Key response header, which the extension reads
and verifies on each page load.
The verification process works by checking the signature against the
concatenation of the request URI, host, and User-Agent
string,
separated by NUL (\0) characters. When the signature is valid,
filter rules carrying $sitekey= with the matching public key
apply to the document.
The value format is two Base64-encoded strings joined by an
underscore. The first string is a DER representation of the RSA
public key and the second is the digital signature. The publisher
generates the key pair, at least 2048 bits and preferably 4096,
and the server signs every request with the private key. The ad
blocker operator allowlists the public key in $sitekey filter
rules rather than issuing keys to publishers.
The same sitekey value must also appear in a data-adblockkey
attribute on the html element. Adblock Plus reads the
attribute on Firefox and Safari and the response header on
Chromium-based browsers, so both delivery methods are required
for the sitekey to work across platforms.
Values
Public key and signature pair
The header value contains a Base64-encoded RSA public key, followed by an underscore, followed by a Base64-encoded signature.
X-Adblock-Key: [base64-public-key]_[base64-signature]
The public key is the value referenced by $sitekey options in
filter lists. The signature is computed over the request URI, host,
and User-Agent string concatenated with NUL (\0) characters, and
is used by the browser extension to confirm the key matches the
request being made.
Example
A site using a sitekey includes this header on every response. The first segment (before the underscore) is the publisher's RSA public key. The second segment is the signature, computed over the request URI, host, and User-Agent concatenated with NUL characters.
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAN..._MoSSrRtMmKgs/Mrbk9BSK...
The extension verifies the signature at page load time. A passing verification activates the filter rules referencing the key, such as the Acceptable Ads exceptions covering the document.