@intellifend/requestshieldjs 2.0.0-qat.204 → 2.0.0-qat.211

package/README.md

@@ -2,6 +2,24 @@
 
 The RequestShield Browser SDK obtains single-use proof-of-work tokens and either attaches them automatically to configured Fetch and asynchronous XHR requests or returns them for application-controlled transport. The customer backend remains the authority that verifies a token and decides how to handle a missing token.
 
+## Choose integration modes
+
+Choose the frontend and backend modes independently:
+
+| Side | Seamless | Manual |
+| --- | --- | --- |
+| Frontend (Browser SDK) | Configure `protect`; the SDK obtains and attaches a token to matching Fetch and asynchronous XHR requests. | Call `getToken()` and attach the returned token in application code. |
+| Java backend | Use the Spring Boot 3 MVC starter and annotate the protected handler; the starter extracts the header, verifies the token and applies its enforcement policy. | Extract the token, call the Java core SDK's `verify(token)` and apply `VerificationResult` before the protected operation. |
+
+For a new integration, prefer Seamless on both sides when the browser transport
+is supported and the backend uses Spring Boot 3 MVC. Otherwise, prefer Manual
+on both sides. All four combinations are supported, so an existing combination
+or an explicit choice can be kept. Backend Seamless requires the token in
+`X-IntelliFend-Token`, including when the frontend uses Manual mode.
+
+`BLOCK` and `MONITOR` are Spring starter enforcement policies, separate from these
+integration modes. Choosing frontend Seamless does not enable backend protection.
+
 ## Install
 
 ### npm / ESM
@@ -200,7 +218,11 @@ For a cross-origin protected application API, allow the `X-IntelliFend-Token` re
 
 ### Manual transport
 
-`X-IntelliFend-Token` is the recommended Manual-mode carrier. A dedicated request-body or form field is also valid when the backend extracts it before verification. Never place a token in a URL path, query string, or fragment because those locations are commonly logged and cached.
+`X-IntelliFend-Token` is the recommended carrier for frontend Manual mode and is
+required by backend Seamless. A dedicated request-body or form field is also
+valid with backend Manual, where application code extracts it before verification.
+Never place a token in a URL path, query string, or fragment because those
+locations are commonly logged and cached.
 
 ### Challenge Server proxies
 

package/dist/checksums.json

@@ -1,18 +1,18 @@
 {
-  "version": "2.0.0-qat.204",
+  "version": "2.0.0-qat.211",
   "algorithm": "sha384",
   "bundles": [
     {
       "name": "intellifend",
       "path": "intellifend.js",
-      "version": "2.0.0-qat.204",
-      "integrity": "sha384-EiSYGXAoIbbj/1cSFLfbnq9Kr9AuVRah2wcs27G6c/En4WaTzpvBs7wkvwQt5zPz"
+      "version": "2.0.0-qat.211",
+      "integrity": "sha384-uSFJiosGxa7BN8DIl3XvpILMhGXyWGuf1bSdW3zszbJc2dnURhUbhPWxMOGxTeHi"
     },
     {
       "name": "intellifend-esm",
       "path": "intellifend.mjs",
-      "version": "2.0.0-qat.204",
-      "integrity": "sha384-yyh4+YzCrfeKv/qw4ClpSQzcP6R5Kk2/C3WfrG9bMR1rzpFB4vZyiQNAhOgbuWxY"
+      "version": "2.0.0-qat.211",
+      "integrity": "sha384-dFwy9vbHXbjtmymion5tAnmawA+1kqXUMDLUsDqQjktg2fTpfS+Vj7WN7RLQ8QXA"
     }
   ]
 }