For AI agents: a documentation index is available at the root level at /llms.txt and /llms-full.txt. Append /llms.txt to any URL for a page-level index, or .md for the markdown version of any page.
HUMAN DashboardHUMAN WebsiteRequest a Demo
Product GuidesEnforcer GuidesMobile SDKAPI ReferenceCustomer support
Product GuidesEnforcer GuidesMobile SDKAPI ReferenceCustomer support
  • General
    • About Enforcers
    • Support first-party HUMAN calls
    • Troubleshoot Enforcer configurations
  • Enforcer frameworks
    • Akamai ESI
    • Apache - C Module
    • ASP.NET
      • Changelog
      • Install the Azure Front Door Enforcer
      • Manually install the Azure Front Door Enforcer
      • API
      • Configuration
    • Callout Enforcer
    • Envoy Proxy
    • F5 BIGIP
    • Fastly JavaScript Compute@Edge
    • Google Cloud Platform (GCP) Callout Enforcer
    • Kong Plugin
    • NGINX - C Module
    • NGINX - LUA Module
    • PHP
    • Python
    • Ruby
    • Salesforce Commerce Cloud Cartridge
LogoLogo
Login
Login
HUMAN DashboardHUMAN WebsiteRequest a Demo
On this page
  • April 9, 2026
  • Version 1.4.0
  • December 17, 2025
  • Version 1.3.0
  • July 3, 2025
  • Version 1.2.1
  • July 2, 2025
  • Version 1.2.0
  • June 10, 2025
  • Version 1.1.1
  • December 28, 2023
  • Version 1.1.0
  • July 31, 2023
  • Version 1.0.1
  • June 29, 2023
  • Version 1.0.0
  • May 4, 2023
  • Version 0.2.0
  • February 24, 2023
  • Version 0.1.2
Enforcer frameworksAzure Front Door

Changelog

April 9, 2026
April 9, 2026

December 17, 2025
December 17, 2025

July 3, 2025
July 3, 2025

July 2, 2025
July 2, 2025

June 10, 2025
June 10, 2025

December 28, 2023
December 28, 2023

July 31, 2023
July 31, 2023

June 29, 2023
June 29, 2023

May 4, 2023
May 4, 2023

February 24, 2023
February 24, 2023

Older posts

Next
Built with

Version 1.4.0

Added

  • Data enrichment header support
  • Added is_sensitive_route field to risk API and async activities
  • Added update_reason and request_id fields to telemetry activity
  • Added proxy support (px_proxy_url)
  • Hard Block support for MCP, Agentic Trust protection
  • Added original vid from cookie on all activities under orig_cookie_vid
  • Added request object to response custom parameters custom function

Version 1.3.0

Added

  • Support for enforcer_function_app_host and kind parameters in the Enforcer CLI for the HUMAN Security Azure Enforcer.
  • CI tool enhancements to generate Azure Function App configurations based on the selected function app kind

Fixed

  • Use X-Azure-SocketIP instead of X-Azure-ClientIP for client IP extraction.

Version 1.2.1

Added

  • Fixed the validation of the Enforcer config path in the CLI tool.

Version 1.2.0

Added

  • Configuration for adding the Secure flag to PXHD cookie.
  • GraphQL query keyword GraphQL query keyword extraction via string/regex (px_graphql_keywords) and custom function (px_extract_graphql_keywords)
  • Support for interpreting regex-formatted strings in various configurations.
  • Added support for Response custom parameters 11-20 for async activities.
  • Support for px_async_timeout configuration which applies to async activities, telemetry, remote logger, and remote configuration
  • Added cookie secret rotation support
  • Added a CLI for generating Azure Front Door resources for the HUMAN Security Azure Enforcer.
  • Build files for ESM, CJS, and declarations.

Changed

  • Updated JS Core to v0.30.1
  • Using raw URL instead of parsed URL in block page captcha script query parameter
  • converted fields: login_successful_reporting_method, sent_through of CredentialEndpointConfiguration to optional.
  • Aligned the telemetry activity structure to spec
  • Updated the captcha template

Fixed

  • Bug fixes related to GraphQL operation name extraction and telemetry regex handling.
  • Fixed issue where unvalidated _pxvid value was added to the captcha page

Version 1.1.1

  • Fixed Set-Cookie response header flattening issue, using built-in Cookie type

Version 1.1.0

  • Added support for header-based logger feature
  • Added support for Hype Sale Challenge feature
  • Added support for url decode reserved characters feature
  • Added a configuration for secure PXHD
  • Added a configuration for first party timeout
  • Added base64-encoded URL to captcha script query parameters on block pages
  • Changed Bot Defender captcha page to client-side first party timeout
  • Aligned and added new fields to the risk API and async activities
  • Various bug fixes and more accurate TypeScript typings

Version 1.0.1

  • Normalized URL parsing
  • Fixed a minor bug where block pages would add “/captcha.js” when custom first party captcha endpoint was configured
  • Fixed occasional 502 errors on first party sensor requests due to transfer-encoding: chunked header

Version 1.0.0

  • Added CORS support
  • Added custom first party endpoints support
  • Added Credential Intelligence, including support for:
    • Credential path matching via exact route or regular expression
    • Extracting credentials from body, header, query-param, or via custom callback
    • Single-step (v2) and multistep (multistep_sso) hashing protocols
    • Reporting on login successful via status code, body regex, header, or via custom callback
    • Sending additional S2S activity automatically, via API function call, or transfer via request headers
    • Sending the raw username on the additional S2S activity if configured
  • Added Account Defender, including support for:
    • Reporting of the cross tab session cookie
    • Extracting user ID and additional fields from cookie- or header-based JWT
  • Changed where the Enforcer context is saved from the Enforcer to the Azure execution context
    • Allows for initializing the Enforcer outside the HTTP trigger function
    • Requires API changes in postEnforce function, which must now receive the Azure context as a parameter

Version 0.2.0

  • Added support for GraphQL including:
    • Customized GraphQL routes
    • Multiple GraphQL operations
    • Sensitive GraphQL operations by name or type
  • Added support for batched activities
  • Changed API for Enforcer enforce() and postEnforce() return values to align with JS Core v0.5.0
  • Changed API for creating default HTTP trigger (providing ConfigurationParams rather than Enforcer instance)
  • Moved rollup.config.js file to example folder

Version 0.1.2

  • Removed images from npm package