What's new

Version 8.3.1

Released 2022-08-23

  • Improved validation of pxvid cookie.

Version 8.3.0

Released 2022-07-28

  • Added support for User identifiers feature - extract application user id and additional fields from JWT token.
    enables Account defender support on Fastly Enforcer.
  • Fixed send redundant page_requested in addition to block activity on sensitive routes on specific cases bug.

Version 8.2.0

Released 2022-06-30

  • Added configurable first party sensor endpoint to circumvent adblockers that prevent requests to the default init.js endpoint. The default init.js endpoint remains active even when a custom endpoint is configured. Note that the sensor endpoint must be changed to use the custom endpoint in the JS snippet as well.

Version 8.1.0

Released 2022-04-10

  • Added Custom logo in block JSON response
  • Updated block page to use new template

Version 8.0.2

Released 2022-03-14

  • Credential Intelligence - added ci_version, sso_step, credentials_compromised fields to block activity for complete visibility for the CI feature on PerimeterX's portal.
  • Improved custom block page code structure and code separation for in PX_CUSTOM.vcl and Internal code.

Version 8.0.1

Released 2022-02-15

  • Improved upgradability
  • Updated px_metadata.json
  • Removed redundant default values assignments from px_configs table

Version 8.0.0

Released 2022-02-03

  • Added Sensitive GraphQL operation support, in order to distinguish between GraphQL operations that are sensitive and require RISK validation, support for GraphQL detection enhancement.
  • Added Additional Activity Handler support - customizable callback The Enforcer runs after sending page_requested or block_activity.
  • Added Filter by HTTP method, user agent, route and IP - customizable callbacks that can skip Enforcer validation flow based on rules of the request HTTP method, user agent, route or IP.
  • Added Support First Party Gzip Compression - Allowing compression of first party content such as PerimeterX's sensor.
  • Core refactor - The enforcer is now support automatic update.
  • Minor bug fixes and improvements

Version 7.2.0

Released 2022-01-23

  • Added Support for credentials intelligence protocols v1 and multistep_sso
  • Added Support for login successful reporting methods header, status, and custom
  • Added Support for automatic sending of additional_s2s activity
  • Added Support for manual sending of additional_s2s activity via request header
  • Added Support for sending raw username on additional_s2s activity
  • Added Support for login credentials extraction via custom callback
  • Added New request_id field to all enforcer activities
  • Added Login credentials extraction handles body encoding based on Content-Type request header (supports application/json and application/x-www-form-urlencoded)
  • Added Successful login credentials extraction automatically triggers risk_api call without needing to enable sensitive routes
  • Fixed the bug of Unset X-PX-uuid header before sending request to customer's origin

Version 7.1.6

Released 2022-01-17

  • Fixed the bug of Fastly WAF is called twice on some requests due to restart caused by the Enforcer.

Version 7.1.5

Released 2021-12-29

  • Added server_info_origin to all Enforcer activities - indicates which CDN POP/Datacenter the request hit.

Version 7.1.4

Released 2021-10-25

  • Added Compromised credentials header support - indicates the origin of that a compromised credentials was detected by PerimeterX.
  • Added CDN Deploy Tool installation support - support for clean/install of the enforcer using automated tool.

Version 7.1.3

Released 2021-07-01

  • Changed initial, threshold, and window configs for backend health check to align with Fastly new limitations and avoid requests timeouts.

Version 7.1.2

Released 2021-06-28

  • increased timeout for backend health check to align with Fastly new limitations and avoid requests timeouts.

Version 7.1.1

Released 2021-06-03

  • Added support for login credentials extraction - This feature extracts credentials (hashed username and password) from requests and sends them to PerimeterX as additional info in the risk api call. The feature can be toggled on and off, and may be set for any number of unique paths.

Version 7.1.0 (REMOVED)

Released 2020-11-26

  • Added tier 2 for CSP report only policy
  • Moved to user subroutines instead of vcl snippets in main.vcl to enforce code order on Main.vcl file.
  • Moved to using px_shield snippet instead of do_shield subroutine.
  • Updated main.vcl base file to be aligned with Fastly's new boilerplate format.
  • Fixed the issue of missing vid in risk_api activity when call reason is cookie_expired
  • Fixed the issue of missing risk_rtt field in block activity

Version 6.1.1

Released 2020-08-12

  • Fixed the issue of module version is sent without version number

Version 6.1.0

Released 2020-08-10

  • Added Send page_response activity
  • Code optimization to reduce memory usage

Version 6.0.0

Released 2020-07-21

  • Added support for remote data
  • Added CSP module (Content Security Policy)

Version 5.0.10

Released 2020-06-18

  • Fixed the issue of invalid cookies by limit cookie characters to a specific range of characters
  • Added px_orig_cookie field on page_requested and block to contain the original cookie value

Version 5.0.9

Released 2020-06-17

  • Fixed cookie with non-printable characters fix may cause being mishandled.

Version 5.0.8

Released 2020-05-20

  • Fixed Telemetry Json formatting

Version 5.0.7

Released 2020-04-22

  • Added support for PXHD cookie secure mode via config

Version 5.0.6

Released 2020-03-10

  • Fixed Handle header size overflow. Fail-Open or Fail-Close is configurable in such case.

Version 5.0.5

Released 2020-02-20

  • Removed hard-coded tokens that required Fastly Deploy Tool to be used
  • Detect edge better to prevent attacks

Version 5.0.4

Released 2020-01-28

  • delete x-px-cookie-data header
  • Header px-orig-cookie to include the original cookie in case of decryption failed
  • Added utf-8 validation before requesting px backend to prevent s2s_error

Version 5.0.3

Released 2019-12-08

  • Fixed the issue of page_requested not being sent due to redundant spaces

Version 5.0.0

Released 2019-11-28

  • Added support for single or multiple (4) backends to work with PerimeterX
  • Decreased number of headers being used on PX module.
  • Fixed the issue of expired cookie with year of 1990 and below was not parsed well.

Did this page help you?