@anonympins/fingerprint 0.3.5 → 0.3.7

package/CHANGELOG.md

@@ -1,3 +1,43 @@
+## Version 0.3.7
+
+### 📊 Prometheus Metrics & Monitoring (JS/PHP)
+- **Prometheus metrics export support**:
+- Implemented a metrics generator using the standard Prometheus format (`text/plain`).
+- Exported active configuration indicators: weight (`fingerprint_security_weight`) and thresholds (`fingerprint_security_threshold`).
+- Real-time export of Auto-Tuner performance metrics: false positive rate (`fingerprint_autotuning_false_positive_rate`) and false negative rate (`fingerprint_autotuning_false_negative_rate`).
+- Secured access via a customizable authorization callback (`metricsAuthorizationCallback`) supporting blocking and secure redirects.
+
+### ⚙️ Background Pareto-Optimal TTL Tuning (JS)
+- **Non-blocking asynchronous optimization**:
+- Added `runBackgroundTtlOptimization`, which runs periodically in the background without blocking the event loop.
+- Utilized a multi-objective genetic algorithm to dynamically calculate a Pareto front of optimal TTLs based on suspicion scores.
+- Implemented instant linear interpolation from the optimization cache for efficient ticket TTL assignment (`determineOptimalTicketTtl`).
+
+### 🚀 Maintenance
+- **Repository cleanup**:
+- Removed obsolete temporary specification files (`enhancements.md`).
+
+## Version 0.3.6
+
+### 🛡️ Sybil Protection & Auto-Tuner Hardening (JS/PHP)
+- **Auto-Tuner Freeze Vulnerability Fix (Anti-Flood)**:
+  - Resolved a vulnerability allowing an attacker to indefinitely freeze the auto-tuner by flooding it with simple requests (`request_passed`), causing the high-confidence log ratio to plummet below the 5% threshold.
+  - Enhanced `sanitizeTrafficData` to balance, shuffle, and cap the proportion of clean logs (`request_passed`) relative to suspicious logs.
+  - Added an absolute fallback trigger condition (`MIN_HIGH_CONFIDENCE_COUNT = 10`) in the optimizer to bypass the 5% minimum ratio when a sufficiently strong signal is present.
+- **Defense Against Sybil Attacks (Data Poisoning)**:
+  - Limited the contribution of each `deviceId` to a maximum of 2% of the total dataset within the traffic sanitizer, preventing a single attacker from manipulating safety threshold optimization calculations.
+- **Cryptographic Securing of Challenge Context (HMAC)**:
+  - Systematic HMAC-SHA256 signing of the challenge payload (`clientSecret`, `cpuTarget`, `fingerprint`, `memDifficulty`, `originalPath`, and client IP) using the global secret.
+  - Strict validation of challenge context integrity upon submission to counter injection or storage tampering attacks.
+
+### ✨ New Features & Improvements
+- **Sequential Path Enumeration Detection (Scraping)**:
+  - Integrated a detection system for requests with identical, incremental structures (e.g., `/product/1`, `/product/2`, `/product/3`).
+  - Automatically applies an enumeration penalty score (`enumerationScore`) of 80% of the pattern weight during unique sequential requests on the same URL pattern.
+- **Network Roaming Tolerance & Strict Hardware Identity**:
+  - Upgraded `isTicketValid` to tolerate legitimate user IP changes (roaming) within the same network block (IPv4/IPv6 subnet).
+  - Automatic fallback to robust hardware identity validation (`deviceId` and `deviceHash` cryptographically verified via HMAC) if the user completely switches networks (e.g., moving from Wi-Fi to 4G).
+
 ## Version 0.3.5 (Hotfix)
 
 ### 🛡️ Critical Fixes & Security Hardening:
@@ -93,7 +133,7 @@ This release marks a major expansion of the library, introducing a full-featured
 
 ### ✨ New Features
 
-*   **Full PHP Support**: The library is now available for PHP 7.4+ with a feature set equivalent to the Node.js version.
+*   **Full PHP Support**: The library is now available for PHP 8.0+ with a feature set equivalent to the Node.js version.
     *   **Direct Integration**: A `DirectFingerprint` class allows for easy integration into any PHP application, including legacy codebases, by interacting directly with PHP's superglobals.
     *   **PSR-15 Middleware**: A `FingerprintMiddleware` is provided for modern, framework-agnostic integration with applications that follow PSR-7, PSR-15, and PSR-17 standards (e.g., Slim, Laminas).
     *   **Pluggable Datastores**: The PHP version supports the same pluggable store architecture, allowing state to be persisted in Redis, databases, or other external systems.