Enforcer frameworksJava

Installation

You can learn how to install the Java Enforcer with this article.

The Java Enforcer is published as two Maven artifacts. Both share the same version number and public API (com.perimeterx.*); choose the artifact that matches your servlet namespace and application server.

ArtifactServlet APIUse when
perimeterx-sdkjavax.servlet (Java EE 8)Spring Boot 2.x, Tomcat 9 and earlier
perimeterx-sdk-jakartajakarta.servlet (Jakarta EE 9+)Spring Boot 3.x, Tomcat 10+

Prerequisites

  • JDK: There are different JDK requirements depending on the artifact:
    • perimeterx-sdk (javax): JDK 1.7 or higher
    • perimeterx-sdk-jakarta: JDK 17 or higher (required by Jakarta Servlet 6/Spring Boot 3).
  • If you are using a Java version earlier than 8u161, you may need to install the JCE Unlimited Strength Policy files to enable unlimited strength cryptography. If you don’t do this, you may see Unlimited Strength Jurisdiction Policy errors on startup. This is enabled by default in Java version 9 and later.
  • Your unique HUMAN information:
    • Your Application ID. You can find this under Platform Settings > Applications > Overview in the HUMAN console. If you have multiple environments, you will also have multiple Application IDs, so be sure to choose the correct ID for the environment you want to install on.
    • Your Server Token. You can find this under Platform Settings > Applications, then selecting an application and navigating to Application settings > Server token.
    • Your Risk Cookie Key. You can find this under Bot Defender > Policies > Policy Settings > Policy Information.

Installation

Use this artifact for Spring Boot 2.x, Tomcat 9 and earlier, and other stacks that still use the javax.servlet namespace.

1

Add the SDK dependency

Add the following dependency to your pom.xml or build.gradle file:

<!-- Add perimeterx-sdk to pom.xml -->
<dependency>
   <groupId>com.perimeterx</groupId>
   <artifactId>perimeterx-sdk</artifactId>
   <version>${VERSION}</version>
</dependency>
2

Integrate the Enforcer as a Servlet Filter

Create a filter that intercepts all incoming requests and verifies them with HUMAN. Be sure to include your HUMAN Application ID, Server Token, and Cookie Key.

You only need to include the responseWrapper section found at the end of the code example if you use Credentials Intelligence.

Integration example
import com.perimeterx.api.PerimeterX;
import com.perimeterx.http.RequestWrapper;
import com.perimeterx.http.ResponseWrapper;
import com.perimeterx.models.PXContext;
import com.perimeterx.models.configuration.ModuleMode;
import com.perimeterx.models.configuration.PXConfiguration;
import com.perimeterx.models.exceptions.PXException;
import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;
import java.io.IOException;
@WebFilter("/*")
public class HumanFilter implements Filter {
   private PerimeterX enforcer;
   @Override
   public void init(FilterConfig filterConfig) throws ServletException {
         try {
            PXConfiguration config = PXConfiguration.builder()
                    .appId("<APP_ID>") // replace with your HUMAN Application ID
                    .cookieKey("<COOKIE_KEY>") // replace with your HUMAN Cookie Key
                    .authToken("<AUTH_TOKEN>") // replace with your HUMAN Server Token
                    .moduleMode(ModuleMode.BLOCKING)
                    .build();
            this.enforcer = new PerimeterX(config);
         } catch (PXException e) {
            throw new ServletException("Failed to initialize HUMAN Enforcer", e);
         }
   }
   @Override
   public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
                        FilterChain filterChain) throws IOException, ServletException {
         HttpServletRequest req = (HttpServletRequest) servletRequest;
         HttpServletResponse resp = (HttpServletResponse) servletResponse;
         try {
         // Wrap the request to allow reading the body multiple times
         req = new RequestWrapper(req);
         // Verify the request with HUMAN
         PXContext ctx = enforcer.pxVerify(req, new HttpServletResponseWrapper(resp));
  
         // Block or First Party
         if (ctx != null && ctx.isHandledResponse()) {
              return;
         }
  
         // Pass request
         filterChain.doFilter(req, resp);
          
         // Post-verify for login response validation (Credentials Intelligence)
         ResponseWrapper responseWrapper = new ResponseWrapper(resp);
         enforcer.pxPostVerify(responseWrapper, ctx);
         } catch (Exception e) {
            // Fail open in case of Exception
            filterChain.doFilter(servletRequest, servletResponse);
         }
   }
}