> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# AWS Lambda@Edge changelog

## July 22, 2026

## 4.11.0

### Added

* Redirect Action support
* Added `undici` HTTP client implementation
* Added `risk_rtt` field to activities in case of S2S timeout
* Added `PhinHttpClientOptions` to `PhinHttpClient` constructor to support custom agents
* Telemetry by risk on GET method - adjusted telemetry requested flag on `risk_api` response
* MCP Protection support
* Send original vid from cookie on all activities under `orig_cookie_vid`
* Support for JWT key names that contain dots (such as URLs) when extracting the user id and additional fields
* Custom block on error message configuration support

## May 27, 2026

## 4.10.1

### Added

* Pass request object to response custom parameters custom function
* Custom block on error message configuration support

## March 31, 2026

## Version 4.10.0

* MCP Protection support
* Send original vid from cookie on all activities under orig\_cookie\_vid

## March 8, 2026

## Version 4.9.0

* Added **Hard Block** support, which lets you customize the Hard Block page that's displayed to users when a request is blocked without a challenge. Hard Block customization options use the same configuration options as the regular Challenge page. Be sure to update the appropriate configuration options to customize the Hard Block page, **not** the block page template. The relevant configuration options are:
  * `px_custom_logo`: Adds a custom logo to the Challenge and Hard Block pages. Maps to `{{customLogo}}` in the block page template.
  * `px_css_ref`: Adds a custom CSS file to the Challenge and Hard Block pages. Maps to `{{cssRef}}` in the block page template.
  * `px_js_ref`: Adds a custom JS file to the Challenge and Hard Block pages. Maps to `{{jsRef}}` in the block page template.
  * `px_first_party_enabled`: A boolean flag to enable first party mode. Maps to `{{firstPartyEnabled}}` in the block page template.

## January 27, 2026

## Version 4.8.1

* Added compression for `px-context` header to avoid AWS CloudFront request size limits (20KB) for HumanActivities Lambda

## November 9, 2025

## Version 4.8.0

* Added `is_sensitive_route` field to risk api and async activities
* Added `request_id` to telemetry activity details
* Telemetry activity update\_reason field updated to reflect the reason for telemetry activity:
  * `command` - incoming telemetry request received
  * `risk` - telemetry triggered via risk response field

## October 16, 2025

## Version 4.7.0

* Added internal tool for generating deployment manifests

## August 20, 2025

## Version 4.6.0

* Support for adding a data enrichment header (new `px_data_enrichment_header_name` configuration)
* Added response custom parameters to supported features and supported it in the CI workflows
* Added Documentation enforcement workflow - verify that the documentation is up to date with the latest changes in the codebase

## May 31, 2025

## Version 4.5.0

* Improvements to request RTT and Lambda execution time by sending async HTTP requests in subsequent Lambda invocations
* Added support for interpreting regex-formatted strings (e.g., `"/^/regex/path$/i"`) as regular expressions for the following configurations:
  * px\_sensitive\_routes
  * px\_monitored\_routes
  * px\_enforced\_routes
  * px\_graphql\_routes
  * px\_filter\_by\_route
  * px\_filter\_by\_user\_agent
  * px\_graphql\_keywords
  * px\_sensitive\_graphql\_operation\_names
  * px\_login\_credentials\_extraction object fields `path` (when `path_type` is `"regex"`) and `login_successful_body_regex`

## March 25, 2025

## Version 4.4.0

* Added `px_token_version` configuration to enable support for cookie v2 (cookie v3 is default)
* Support for regular expressions in `px_filter_by_user_agent`
* Extracting GraphQL `operationName` and `variables` even if the `query` field is not present
* Fixed issue where telemetry would fail if `px_cookie_secret` was an array of cookie strings

## November 7, 2024

## Version 4.3.2

* Fixed a bug where malformed URLs resulted in an uncaught exception

## August 13, 2024

## Version 4.3.1

* Added support for cookie secret rotation
* Fixed a GraphQL parsing issue

## July 18, 2024

## Version 4.3.0

* Added `HumanSecurityFirstParty` for more modular use of first party functionality within Lambdas
* Added GraphQL query keyword extraction via string/regex (`px_graphql_keywords`) and custom function (`px_extract_graphql_keywords`)
* Changed telemetry activity to include all types of config and include redacted sensitive configuration fields
* Changed default value for `px_bypass_monitor_header` from empty string to "x-px-block"
* Changed configuration `px_sensitive_graphql_operation_names` to include regular expressions and apply to extracted GraphQL keywords as well
* Fixed issue where unvalidated `_pxvid` value was added to the captcha page
* Fixed issue where configured regular expressions with the global flag (`g`) occasionally failed on calls to `test()`

## April 1, 2024

## Version 4.2.0

* Added ability to pass the `Context` object to the Enforcer to use `awsRequestId` as the HUMAN request ID
* Fixed bug where First Party XHR body was not transferred properly
* First party handler returns response instead of throwing error on non-first party requests
* Updated the captcha template
* Using raw URL instead of parsed URL in block page captcha script query parameter

## February 21, 2024

## Version 4.1.0

* Added base64-encoded request HTTP method to captcha script query parameters on block pages
* Fixed JSON parsing issue with generated package.json for CommonJS library build

## February 12, 2024

## Version 4.0.0

* Add TypeScript support
* Changed to use async/await syntax rather than callback syntax
* Refactor to base on JS Core library
* Maintains support for:
  * additional activity handler
  * advanced blocking response
  * block activity
  * block page captcha
  * block page rate limit
  * bypass monitor header
  * client ip extraction
  * cookie v3
  * cors support
  * credentials intelligence
  * css ref
  * custom cookie header
  * custom first party endpoints
  * custom logo
  * custom parameters
  * enforced routes
  * filter by extension
  * filter by http method
  * filter by ip
  * filter by route
  * filter by user agent
  * first party
  * graphql support
  * header based logger
  * hype sale challenge
  * js ref
  * logger
  * mobile support
  * module enable
  * module mode
  * monitored routes
  * page requested activity
  * pxde
  * pxhd (conditionally)
  * risk api
  * sensitive headers
  * sensitive routes
  * telemetry command
  * url decode reserved characters
  * user identifiers
  * vid extraction

## January 11, 2024

## Version 3.12.0

* Support for url decode reserved characters feature
* Support in lambda enforcer for non-reserved characters

## December 21, 2023

## Version 3.11.0

* Support for header-based logger
* Added risk\_start\_time and enforcer\_start\_time fields to enforcer activities.
* Configuration for first party timeout
* Updated the PX first-party requests to include a connection timeout
* Added failOnEmptyBody flag for callServer to specify weather or not a request should fail if it has no body.
* Bot Defender captcha page includes client-side first party timeout
* Changed the structure of the headers field on async activities to array

## May 16, 2023

## Version 3.10.0

* Custom cookie header is processed in addition to (not instead of) default cookie header
* Custom cookie header default value has been set to x-human-cookies
* Added PXHD from risk response to the async activities

## April 2, 2023

## Version 3.9.0

* Added support for handling graphQL requests with empty query field
* Added support custom is sensitive request via function
* Fixed cors custom block response headers and preflight handling functions

_Showing the 20 most recent of 35 entries. Append `/llms.txt` to the changelog URL for the complete index._