Version 3.2.0

Added

• Support for credentials intelligence protocols v1 and multistep_sso
• Support for login successful reporting methods header, status, and custom
• Support for automatic sending of additional_s2s activity
• Support for manual sending of additional_s2s activity via header or API call
• Support for sending raw username on additional_s2s activity
• Support for login credentials extraction via custom callback
• New request_id field to all enforcer activities

Changed

• Login credentials extraction handles body encoding based on Content-Type request header
• Successful login credentials extraction automatically triggers risk_api call without needing to enable sensitive routes

Fixed

• Enforced routes work in monitor mode
• Bypass monitor header works with configured monitored routes

Version 3.1.1

• server_info_origin to all Enforcer activities, indicates which CDN POP/Datacenter the request hit
• sensitive route based on GraphQL payload
• Enforced route bugfix

Version 3.1.0

Changed

• Login credentials extraction sends hashed credentials (creds) instead of pass
• Login credentials extraction normalizes username field to lowercase prior to hashing
• Login credentials extraction fields align with spec (all snake_case, not camelCase)
• Login credentials extraction handles body encoding based on Content-Type request header

Added

• Login credentials extraction paths are added as sensitive routes automatically
• Added raw_username field with default value null to additional_s2s activity

Version 3.0.3

• Additional activity header feature support

Version 3.0.2

add Nonce support in CSP header

Version 3.0.1

Added support for compromised credentials header

Version 3.0.0

Configuration changes

Bug fix: Decryption failed on mobile SDK error

Merge pull request #169 from PerimeterX/dev

Version 2.13.1 from dev

CSP support for node core

Merge pull request #165 from PerimeterX/dev

Dev to master

bypassMonitor reporting fix

Merge pull request #162 from PerimeterX/dev

Version 2.12.1