> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Akamai EdgeWorker changelog

## October 6, 2026

## 4.9.1

### Fixed

* Fixed URLs containing special characters being reported without a domain or path on `risk_api` activities.

## August 27, 2026

## 4.9.0

### Added

* Added Hard Block support: split the Hard Block response into a minimal inline stub + a NetStorage-hosted script (`b.js`), mirroring the existing CAPTCHA block page pattern, so that Hard Block (action `b`) works within Akamai's `onClientRequest` 2048-character response size limit.
  * Note that this requires uploading the new `netstorage/px/b.js` file to NetStorage alongside the existing `c.js`.

## July 6, 2026

## Version 4.8.0

### Added

* Added support for handling multiple mobile authorization headers in mobile traffic flows.

## June 9, 2026

## 4.7.0

### Added

* Support for JWT key names that contain dots (such as URLs) when extracting the user ID and additional fields

## April 16, 2026

## Version 4.6.1

* Send original vid from cookie on all activities under orig\_cookie\_vid
* Pass request object to response custom parameters custom function

## March 11, 2026

## Version 4.6.0

* Replaced `crypto-es` with Akamai's built-in `crypto` module (Web Crypto API) to reduce bundle size
* Replaced `whatwg-url` with the lightweight `UrlImpl` regex-based parser from `perimeterx-js-core`
* Removed `TextEncoder`/`TextDecoder` polyfill (no longer needed)
* Bundle size reduced from \~493 KB to \~208 KB, resolving cold-start `InitCpuTimeoutError`

## March 9, 2026

## Version 4.5.0

* Support for `px_enrich_response_custom_parameters` custom function.

## March 2, 2026

## Version 4.4.2

* Adjusted PM static rule to exclude HEAD requests in addition to GET

## February 15, 2026

## Version 4.4.1

* Telemetry by risk - adjusted telemetry requested flag on risk\_api response

## October 16, 2025

## Version 4.4.0

* Added `is_sensitive_route` field to risk api and async activities
* Added `x-ew-socket-ip` header to Risk API requests
* Telemetry activity `update_reason` field updated to reflect the reason for telemetry activity:
  * `command` - incoming telemetry request received
  * `risk` - telemetry triggered via risk response field
* Added `request_id` to telemetry activity details

## August 25, 2025

## Version 4.3.0

* Support for adding a data enrichment header (new `px_data_enrichment_header_name` configuration)
* Added Documentation enforcement workflow - verify that the documentation is up to date with the latest changes in the codebase

## July 29, 2025

## Version 4.2.0

* Added the domain to the enforcer block page src to ensure the block page is served correctly from NetStorage

## May 8, 2025

## Version 4.1.1

* Added argparse as dependency rather than dev dependency to allow the provided CLI tool to work properly

## May 5, 2025

## Version 4.1.0

* Added URL decode reserved characters feature support (`PX_DEC_URL_RESERVED_CHARS` configuration)
* Added Secure PXHD cookie support (`PX_SECURED_PXHD_ENABLED` configuration)
* Added the WhatWG URL dependency to improve URL parsing
* Changed Property Manager variables to remove unnecessary `PMUSER_PX_EW_IP` variable
* Changed handler creation functions to always retrieve configuration from incoming request variables rather than saving the enforcer in closure
* Changed `onClientRequest` to remove context and remote config headers from incoming request before processing
* Fixed IP parsing issue by using `AK_CLIENT_REAL_IP` instead of `AK_CLIENT_IP`
* Fixed issue that enabled users to add erroneous Risk API GET headers

## April 16, 2025

## Version 4.0.0

* Refactor to use JS Core module, maintaining support for:
  * additional\_activity\_handler
  * advanced\_blocking\_response
  * block\_activity
  * block\_page\_captcha
  * block\_page\_rate\_limit
  * bypass\_monitor\_header
  * client\_ip\_extraction
  * cookie\_v2
  * credentials\_intelligence
  * css\_ref
  * custom\_cookie\_header
  * custom\_logo
  * cors\_support
  * custom\_parameters
  * enforced\_routes
  * filter\_by\_extension
  * filter\_by\_http\_method
  * filter\_by\_ip
  * filter\_by\_route
  * filter\_by\_user\_agent
  * filter\_by\_custom\_function
  * first\_party
  * graphql\_support
  * js\_ref
  * logger
  * mobile\_support
  * module\_enable
  * module\_mode
  * monitored\_routes
  * page\_requested\_activity
  * pxde
  * pxhd
  * risk\_api
  * sensitive\_headers
  * sensitive\_routes
  * vid\_extraction
  * telemetry\_command
  * user\_identifiers
* Released as a library for modular use
* Added support for remote configuration using EdgeKV
* Added support for header-based logger
* Added support for regex flags in configuration

## November 19, 2024

## Version 3.5.4

* Risk\_api call fails in case of a non-ASCII character on a request header

## September 16, 2024

## Version 3.5.3

* Response provider enforcer (for Credential Intelligence, GraphQL) includes HTTP response status code on page\_requested and block activities

## September 5, 2024

## Version 3.5.2

* User request's Authorization header no longer overriding the header that is being sent on risk api
* Upgrading tests version

## August 13, 2024

## Version 3.5.1

* Fixed an issue with parsing cookie values

## July 8, 2024

## Version 3.5.0

* Added all request headers to activities instead of only specific ones
* Added support for the sensitive headers feature

_Showing the 20 most recent of 43 entries. Append `/llms.txt` to the changelog URL for the complete index._