# Change Log All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). ## [3.15.1] - 2024-01-17 ### Added - Removed support for header-based logger feature ## [3.15.0] - 2024-01-17 (removed) ## [3.14.0] - 2024-01-11 ### Added - Support for url decode reserved characters feature ## [3.13.0] - 2023-12-21 ### Added - Added `failOnEmptyBody` flag for `callServer` to specify weather or not a request should fail if it has no body. - Updated the configuration of PX first-party requests to include a connection timeout ### Changed - Updated the captcha template to handle empty captcha responses ## [3.12.0] - 2023-12-03 ### Added - Support for header-based logger feature - Added `risk_start_time` and `enforcer_start_time` fields to enforcer activities. ### Changed - Changed the structure of the headers field on async activities to array ## [3.11.0] - 2023-05-16 ### Changed - Custom cookie header is processed in addition to (not instead of) default cookie header - Custom cookie header default value has been set to x-px-cookies - Added PXHD from risk response to the async activities ## [3.10.1] - 2023-03-29 ### Fixed - Bug fixed in pxCookieValidator which fails on invalid variable name. ## [3.10.0] - 2023-03-28 (removed) ### Added - Support for handling graphQL requests with empty query field - Support custom is sensitive request via function ## [3.9.0] - 2023-01-29 ### Added - Support for CORS preflight requests and CORS headers in block responses ## [3.8.0] - 2023-01-25 ### Added - Support User Identifiers: CTS and JWT. ## [3.7.0] - 2023-01-15 ### Added - support configurable graphql paths - support multiple queries (Apollo) ### Changed - full scanning the graphql query to parse the operation name. ### Fixed - ignore whitespaces at start of operation name ## [3.6.0] - 2022-11-17 ### Added - Support for `px_modify_context`, a custom function that allows more flexibility for changes to the request context ## [3.5.0] - 2022-10-23 ### Added - Support for `px_custom_first_party_path` configuration ### Changed - Updated dependencies ## [3.4.3] - 2022-06-30 ### Fixed - pxhd cookie is now set with SameSite=Lax ## [3.4.2] - 2022-06-06 ### Fixed - GraphQL - parsed operation name issue ## [3.4.1] - 2022-05-18 ### Added - Update block page to support error handling for mobile. ## [3.4.0] - 2022-05-1 ### Added - Credentials intelligence v2 hashing protocol added and set as default ## [3.3.2] - 2022-04-11 ### Fixed - URLs with query params did not render properly on new block page ## [3.3.1] - 2022-04-10 ### Fixed - Bug fix in new block page ## [3.3.0] - 2022-04-10 ### Added - New block page implementation ## [3.2.2] - 2022-03-09 ### Added - Send PX cookie over risk_api on sensitive routes ## [3.2.1] - 2022-01-31 ### Added - Support for dynamic cookie signing with IP (requires PXHD) ## [3.2.0] - 2022-01-24 ### Added - Support for credentials intelligence protocols `v1` and `multistep_sso` - Support for login successful reporting methods `header`, `status`, and `custom` - Support for automatic sending of `additional_s2s` activity - Support for manual sending of `additional_s2s` activity via header or API call - Support for sending raw username on `additional_s2s` activity - Support for login credentials extraction via custom callback - New `request_id` field to all enforcer activities ### Changed - Login credentials extraction handles body encoding based on `Content-Type` request header - Successful login credentials extraction automatically triggers risk_api call without needing to enable sensitive routes ### Fixed - Enforced routes work in monitor mode - Bypass monitor header works with configured monitored routes ## [3.1.2] - 2022-01-18 ### Added - Code Defender first party XHR and first party Sensor support ## [3.1.1] - 2021-12-29 ### Added - server_info_origin to all Enforcer activities, indicates which CDN POP/Datacenter the request hit - sensitive route based on GraphQL payload ### Fixed - Enforced route bugfix ## [3.1.0] - 2021-11-28 ### Changed - Login credentials extraction sends hashed credentials (`creds`) instead of `pass` - Login credentials extraction normalizes username field to lowercase prior to hashing - Login credentials extraction fields align with spec (all `snake_case`, not `camelCase`) - Login credentials extraction handles body encoding based on `Content-Type` request header ### Added - Login credentials extraction paths are added as sensitive routes automatically - Added `raw_username` field with default value `null` to `additional_s2s` activity ## [3.0.3] - 2021-11-24 ### Added - Additional activity header feature support ## [3.0.2] - 2021-11-14 ### Added - Nonce support in CSP header ## [3.0.1] - 2021-10-25 ### Added - Compromised credentials header support ## [3.0.0] - 2021-09-26 ### Changed - Configuration changes to match [Enforcer Spec v1.0.0](https://github.com/PerimeterX/px-enforcer-spec) ## [2.13.1] - 2021-07-04 ### Added - Bug fix: Cookie decryption fails on mobile sdk error ## [2.13.0] - 2021-06-08 ### Added - CSP Support. ## [2.12.1] - 2021-05-25 ### Fixed - Wrong reporting for bypass monitor header. ## [2.12.0] - 2021-04-08 ### Added - Data Enrichment parsing. ## [2.11.0] - 2021-04-07 ### Added - Support for regular expressions in filter by user agent ## [2.10.0] - 2021-03-29 ### Added - Support for login credentials extraction ## [2.9.0] - 2021-02-09 ### Added - Support for `customCookieHeader` ## [2.8.0] - 2020-11-24 ### Added - New config to support custom logger ### Changed - `telemetry_handler.js` to use the logger in config rather than creating its own - `PxLogger` to directly consume user-defined `params` to remove circular dependecy between `PxConfig` and `PxLogger` ### Fixed - String interpolation syntax errors in `telemetry_handler.js` - Bug where `debug` logs in `PxConfig` never gets called - Issue where `debug` does not check `msg` type the same way `error` does ## [2.7.2] - 2020-10-22 ### Fixed - Support for `ACTIVITIES_TIMEOUT_MS`. ## [2.7.1] - 2020-04-21 ### Added - New config to support `Secure` flag for pxhd cookie ## [2.7.0] - 2020-03-29 ### Added - Support for external activities ## [2.6.2] - 2020-02-11 ### Fixed - Custom parameters for async activities. ## [2.6.1] - 2020-02-11 ### Fixed - `originalRequest` support for ExpressJS. ## [2.6.0] - 2019-12-08 ### Added - Support for filtering traffic by http method ## [2.5.0] - 2019-11-26 ### Added - Support for regex in enforced/whitelisted/monitored specific routes. - Support for filtering traffic by IPs/CIDRs. - Support for filtering traffic by user agents. ## [2.4.1] - 2019-11-19 ### Fixed - cssRef, jsRef string values ## [2.4.0] - 2019-10-15 ### Added - Send HTTP method on async activities - Support for specific enforced routes and specific monitored routes ### Fixed - Upgraded dependency ## [2.3.2] - 2019-10-02 ### Fixed - Upgraded dependency ## [2.3.1] - 2019-09-02 ### Fixed - Upgraded ESLint version ## [2.3.0] - 2019-07-28 ### Added - Support for custom templates - Request object is now passed to `enrichCustomParams` function ### Fixed - PXHD cookie will not echo back from client ## [2.2.1] - 2019-05-24 ### Added - fixed timeout error, lint fixes - removed node 11 from tests because it turned EOL ### Fixed - pxhd cookie not been sent in block activity - Do not echo back pxhd cookie coming from client - set pxhd expiration ## [2.2.0] - 2019-05-06 ### Added - Send telemetry by command ## [2.1.1] - 2019-05-02 ### Fixed - pxConfig setting for proxy - Risk API timeout check ## [2.1.0] - 2019-03-19 ### Added - Add advanced blocking response configuration ## [2.0.0] - 2019-03-14 ### Added - Support for multiple instances of PxEnforcer (for multi px-app in same web app) ### Refactored - Major parts of the code to inject an instance of PxLogger and PX config. ### Changed - Changed PxClient.submitActivities() signature to receive a config object. ## [1.8.0] - 2019-02-25 ### Added - Support for testing blocking flow in monitor mode ### Fixed - VID validity check ## [1.7.0] - 2018-01-11 ### Fixed - Full refactor of proxy support - Lowercasing of json response - Various PXHD related issues ## [1.6.1] - 2018-01-06 ### Fixed - Proxy_url parameter in first-party captcha.js call ## [1.6.0] - 2018-01-02 ### Added - Added PXHD handling - Added async custom params - Added data enrichment cookie handling - Added Proxy support ## [1.5.0] - 2018-10-29 ### Fixed - px_cookie_hmac was missing from risk api calls - First party captcha fallback ### Added - Configurable testing mode - New call reason 'no_cookie_key' ## [1.4.2] - 2018-07-30 ### Fixed - Phin callback related issue - Better handling of activities when customRequestHandler is used - Better error messages for requests ## [1.4.1] - 2018-07-29 ### Fixed - Various fixes regarding page_requested and pass_reason ## [1.4.0] - 2018-07-11 ### Added - Refactored request module to use Phin.js ### Fixed - Better handling for custom request handler ## [1.3.2] - 2018-07-09 ### Fixed - Error handling for non-response requests ## [1.3.1] - 2018-06-19 ### Fixed - Better error handling ## [1.3.0] - 2018-06-10 ### Added - Advanced Blocking Response - Simulated_block property on Risk API call - Enrich Custom Parameters support - Captcha v2 support - Ratelimit support ### Fixed - Empty ipHeaders property handling - Various first party fixes ## [1.2.1] - 2018-02-28 ### Fixed - Sending originial cookie on decryption failed ## [1.2.0] - 2018-02-19 ### Added - Added funCaptcha support for mobile ### Modified - First party mode enabled by default - Improved first party mode - Update templates to support smart snippet ## [1.1.4] - 2018-02-15 ### Fixed - FunCaptcha compatibility for mobile - Various first party fixes ## [1.1.3] - 2018-01-24 ### Modified - Stability related fixes ## [1.1.2] - 2018-01-22 ### Modified - Changed default value for client url ## [1.1.1] - 2018-01-22 ### Modified - Changed default value for first party ## [1.1.0] - 2018-01-22 ### Added - First party support ### Modified - Handle original token for mobile