Enforcer frameworksJava

Upgrading

The upgrade process differs slightly depending on which version you’re upgrading from.

Two things changed in v4.x:

  • isVerified() is deprecated. Use isRequestLowScore() instead for the same check. This is optional and mainly useful for logging to indicate whether the request score was below the blocking threshold.
  • isHandledResponse() is new and returns true when HUMAN already wrote the response (block page or first-party), meaning you cannot continue to filterChain.doFilter

To account for these, update your code accordingly:

1

Replace isVerified with isHandledResponse()

PXContext ctx = enforcer.pxVerify(req, new HttpServletResponseWrapper(resp));
if (ctx != null && ctx.isVerified()) {
    filterChain.doFilter(servletRequest, servletResponse);
}
2

Optional: Add logging to indicate why the response was handled

PXContext ctx = enforcer.pxVerify(req, new HttpServletResponseWrapper(resp));
// isHandledResponse() returns true when HUMAN already wrote the response:
//   - Request was blocked, OR
//   - Request was handled by first-party mechanism
// In both cases, do NOT forward to your application.
if (ctx != null && ctx.isHandledResponse()) {
    // HUMAN already handled the response - do NOT forward
    // Optional: log why the response was handled
    if (ctx.isFirstPartyRequest()) {
          System.out.println("Handled by first-party mechanism");
    }
    if (!ctx.isRequestLowScore()) {
          System.out.println("Blocked request");
    }
    return;
}
filterChain.doFilter(servletRequest, servletResponse);
3

Update the builder syntax

Finally, the old new PXConfiguration.Builder() was replaced by Lombok’s PXConfiguration.builder() and should be replaced accordingly:

PXConfiguration config = new PXConfiguration.Builder()
        .appId("<APP_ID>")
        .build();