Skip to navigation
Enforcer frameworksAzure Front Door

Changelog

April 9, 2026

Version 1.4.0

Added

  • Data enrichment header support
  • Added is_sensitive_route field to risk API and async activities
  • Added update_reason and request_id fields to telemetry activity
  • Added proxy support (px_proxy_url)
  • Hard Block support for MCP, Agentic Trust protection
  • Added original vid from cookie on all activities under orig_cookie_vid
  • Added request object to response custom parameters custom function
December 17, 2025

Version 1.3.0

Added

  • Support for enforcer_function_app_host and kind parameters in the Enforcer CLI for the HUMAN Security Azure Enforcer.
  • CI tool enhancements to generate Azure Function App configurations based on the selected function app kind

Fixed

  • Use X-Azure-SocketIP instead of X-Azure-ClientIP for client IP extraction.
July 2, 2025

Version 1.2.0

Added

  • Configuration for adding the Secure flag to PXHD cookie.
  • GraphQL query keyword GraphQL query keyword extraction via string/regex (px_graphql_keywords) and custom function (px_extract_graphql_keywords)
  • Support for interpreting regex-formatted strings in various configurations.
  • Added support for Response custom parameters 11-20 for async activities.
  • Support for px_async_timeout configuration which applies to async activities, telemetry, remote logger, and remote configuration
  • Added cookie secret rotation support
  • Added a CLI for generating Azure Front Door resources for the HUMAN Security Azure Enforcer.
  • Build files for ESM, CJS, and declarations.

Changed

  • Updated JS Core to v0.30.1
  • Using raw URL instead of parsed URL in block page captcha script query parameter
  • converted fields: login_successful_reporting_method, sent_through of CredentialEndpointConfiguration to optional.
  • Aligned the telemetry activity structure to spec
  • Updated the captcha template

Fixed

  • Bug fixes related to GraphQL operation name extraction and telemetry regex handling.
  • Fixed issue where unvalidated _pxvid value was added to the captcha page
December 28, 2023

Version 1.1.0

  • Added support for header-based logger feature
  • Added support for Hype Sale Challenge feature
  • Added support for url decode reserved characters feature
  • Added a configuration for secure PXHD
  • Added a configuration for first party timeout
  • Added base64-encoded URL to captcha script query parameters on block pages
  • Changed Bot Defender captcha page to client-side first party timeout
  • Aligned and added new fields to the risk API and async activities
  • Various bug fixes and more accurate TypeScript typings
July 31, 2023

Version 1.0.1

  • Normalized URL parsing
  • Fixed a minor bug where block pages would add “/captcha.js” when custom first party captcha endpoint was configured
  • Fixed occasional 502 errors on first party sensor requests due to transfer-encoding: chunked header
June 29, 2023

Version 1.0.0

  • Added CORS support
  • Added custom first party endpoints support
  • Added Credential Intelligence, including support for:
    • Credential path matching via exact route or regular expression
    • Extracting credentials from body, header, query-param, or via custom callback
    • Single-step (v2) and multistep (multistep_sso) hashing protocols
    • Reporting on login successful via status code, body regex, header, or via custom callback
    • Sending additional S2S activity automatically, via API function call, or transfer via request headers
    • Sending the raw username on the additional S2S activity if configured
  • Added Account Defender, including support for:
    • Reporting of the cross tab session cookie
    • Extracting user ID and additional fields from cookie- or header-based JWT
  • Changed where the Enforcer context is saved from the Enforcer to the Azure execution context
    • Allows for initializing the Enforcer outside the HTTP trigger function
    • Requires API changes in postEnforce function, which must now receive the Azure context as a parameter
May 4, 2023

Version 0.2.0

  • Added support for GraphQL including:
    • Customized GraphQL routes
    • Multiple GraphQL operations
    • Sensitive GraphQL operations by name or type
  • Added support for batched activities
  • Changed API for Enforcer enforce() and postEnforce() return values to align with JS Core v0.5.0
  • Changed API for creating default HTTP trigger (providing ConfigurationParams rather than Enforcer instance)
  • Moved rollup.config.js file to example folder