> This page is for Applications Protection. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.humansecurity.com/llms.txt. # Changelog ## July 9, 2026 ## Version 22.4.0 ### Added * Send original VID from cookie on the risk API request under `orig_cookie_vid` * Telemetry activity includes redacted sensitive configuration fields * Telemetry activity includes custom function hash field * Aligned Enforcer telemetry `enforcer_configs` with the telemetry spec by splitting it into `active_config`, `static_config`, and `remote_config` * Added `s2s_call_reason` and `risk_mode` fields to the async activities ## May 27, 2026 ## Version 22.3.0 * Added support for cookie v2 * Send original vid from cookie on all activities under `orig_cookie_vid` ## March 29, 2026 ## Version 22.2.0 ### Added * Added support for filter requests by http method * Added support for enforcing SCAPI requests via the `int_perimeterx_SCAPI` cartridge ### Changed * Aligned cookie v2 validation flow with js-core: structure check, then HMAC validation, then expiry, then block/pass decision * Split cookie v2 decrypt and validation stages to report `cookie_decryption_failed` vs `cookie_validation_failed` correctly on the Risk API ## January 29, 2026 ## Version 22.1.1 ### Changed * Changed handleHeaders implementation to support specific customer's headers structure ## October 22, 2025 ## Version 22.1.0 ### Added * Added support for is sensitive request custom function * Added `is_sensitive_route` field to risk API and async activities * Reporting the cross tab session cookie for AD on async activities and risk API * Added the additional\_risk\_info field to async activities if present on the risk API response * Added custom functions support for Site Gensis and SFRA if onRequest is not wanted. ## September 3, 2025 ## Version 22.0.1 ### Fixed * Added missing `px_cookie` on async activities ## April 28, 2025 ## Version 22.0.0 ### Internal * Added E2E tests GitHub action ### Added * Added Enforcer start time to Risk API activity and async activities * Added domain attribute to the pxhd cookie. * Added `user` and `pass` fields to async activities ### Changed * Moved custom configuration files to dedicated `pxCustomFunctionsConfig.js` file * Aligned the following field names to spec: * `http_status` to `http_status_code` * `ip` to `socket_ip` * `uuid` to `client_uuid` * Improved telemetry error handling and stop the flow correctly after successful telemetry request processing * Added support for configuring the backend URL and collector URL through the configuration * Updated `additionalActivityHandler` custom function to return void instead of a boolean * Updated `pxSensitiveRoutes`, `pxMonitoredRoutes`, `pxEnforcedRoutes`, and `pxFilteredRoutes` to accept a single regular expression pattern instead of an array of strings. * Changed the async activities default url to `https://collector-.perimeterx.net` ### Removed * Removed deprecated `sensitiveRoutesRegex`, `enforcedRoutesRegex`, `monitoredRouteRegex`, and `filteredRoutesRegex` configuration fields ## December 19, 2024 ## Version 21.4.3 ### Fixed * Removed service package to support SiteGenesis compatibility ## June 23, 2024 ## Version 21.4.2 ### Added * Support for filter routes by regex. ### Fixed * Better config handling. ## December 27, 2023 ## Version 21.4.1 ### Changed * Updated deprecated methods used in `PXRequestValidator` and `pxCrypto`. ## August 13, 2023 ## Version 21.4.0 ### Fixed * Fixed \_\_ controllers allowlisting (prevents attackers using \_\_Analytics for POST requests such as `/on/demandware.store/Sites-Hibbett-US-Site/default/__Analytics-Start%2F../GooglePay-PaymentAuthorized`) ## June 7, 2022 ## Version 21.3.0 ### Added * Custom cookie header with the `x-px-cookies` default value * Sending `pxvid` on async activities also when it was extracted from cookie ## April 13, 2022 ## Version 21.2.1 ### Fixed * Fixed bug in bypass monitor header ## Version 21.2.0 ### Fixed * Linter issues * Wrong risk mode sent on Risk API ### Added * Sending email and user creation date on activities (for Account Defender) ## February 2, 2022 ## Version 21.1.1 ### Fixed * Metadata schema was updated to include `PX_loggerSeverity` ## January 3, 2022 ## Version 21.1.0 ### Added * Support for Credentials Intelligence `v2` and `multistep_sso` protocols * Support for login credentials which are sent through `body` (when the content-type is JSON or form-urlencoded), `header` and `query-param` * Support for manual sending of `additional_s2s` activity * Support for sending raw username on `additional_s2s` activity * New `request_id` field to all Enforcer activities ### Changed * Update the default request timeout value of Async and Risk activities to one second ## November 28, 2021 ## Version 21.0.0 ### Changed * Async activities fields align with the spec * Changed the debug mode field configuration name to `px_logger_severity` and its possible values according to the spec * Changed the `px_module_mode` possible values according to the spec ### Fixed * Send the full url with the Risk API activity url field which is included query params if any ### Added * Added implementation for handling `s2s_error` and `s2s_timeout` * Support for monitored routes feature * Support for enforced routes feature * Added 'app\_user\_id' field on Risk API and async activities calls ## December 23, 2020 ## Version 20.3.1 ### Fixed * Mobile token handling for OCAPI ## Version 20.3.0 ### Fixed * Mobile token handling * Mobile response handling ## November 18, 2020 ## Version 20.2.0 ### Added * OCAPI support * PBKDF2 key hashing ### Fixed * Bypass monitor header reporting * Debug flag ## February 3, 2020 ## Version 20.1.0 ### Added * Send telemetry on demand by header * Support for testing blocking flow in monitor mode * Full first-party support * `onRequest` integration * Support for properties in ISML templates ### Fixed * Removed `getWriter()` and replaced it with templates. ## December 25, 2018 ## Version 19.1.0 ### Added * Enrich Custom Parameters support for async activities * Support for PXHD cookies * First-Party fallback for block templates * Support Cookie names extraction _Showing the 20 most recent of 27 entries. Append `/llms.txt` to the changelog URL for the complete index._