npm - perimeterx-js-core - Versions diffs - 0.21.3 → 0.21.5 - Mend

perimeterx-js-core 0.21.3 → 0.21.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (38) hide show

package/lib/cjs/activities/utils.js CHANGED Viewed

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toHeaderEntryArray = exports.createAdditionalS2SActivityDetails = exports.createBlockActivityDetails = exports.createPageRequestedActivityDetails = exports.addResponseDataToAsyncActivityCommonDetails = exports.addRiskApiDataToAsyncActivityCommonDetails = exports.addTokenDataToDetails = exports.addRequestDataToDetails = exports.addServerDataToDetails = exports.addTlsDataToDetails = exports.addProductDataToDetails = exports.addCustomParametersToDetails = exports.addConfigDataToDetails = exports.addRootContextDataToDetails = exports.createCommonActivityDetails = exports.createAsyncActivityCommonDetails = exports.createActivityDetails = exports.createAsyncActivity = void 0;
+exports.toHeaderEntryArray = exports.createAdditionalS2SActivityDetails = exports.createBlockActivityDetails = exports.createPageRequestedActivityDetails = exports.addResponseDataToAsyncActivityCommonDetails = exports.addRiskApiDataToAsyncActivityCommonDetails = exports.addTokenDataToDetails = exports.addRequestDataToDetails = exports.addServerDataToDetails = exports.addTlsDataToDetails = exports.addProductDataToDetails = exports.addCustomParametersToDetails = exports.addConfigDataToDetails = exports.redactCookieSecret = exports.addRootContextDataToDetails = exports.createCommonActivityDetails = exports.createAsyncActivityCommonDetails = exports.createActivityDetails = exports.createAsyncActivity = void 0;
 var utils_1 = require("../utils");
 var products_1 = require("../products");
 var action_1 = require("../action");
@@ -76,8 +76,15 @@ var addRootContextDataToDetails = function (details, context) {
         graphqlData: 'graphql_operations',
         enforcerStartTime: 'enforcer_start_time',
     });
+    if (context.usedCookieSecret) {
+        details.used_cookie_secret = redactCookieSecret(context.usedCookieSecret);
+    }
 };
 exports.addRootContextDataToDetails = addRootContextDataToDetails;
+function redactCookieSecret(secret) {
+    return '***'.concat(secret.substring(secret.length - 3, secret.length));
+}
+exports.redactCookieSecret = redactCookieSecret;
 var addConfigDataToDetails = function (details, config) {
     if (config.remoteConfigVersion) {
         details.remote_config_version = config.remoteConfigVersion;

package/lib/cjs/blocker/utils.js CHANGED Viewed

@@ -17,9 +17,12 @@ var renderHtml = function (htmlTemplate, blockData) {
 exports.renderHtml = renderHtml;
 var createBlockData = function (config, context, base64Utils) {
     var captchaScriptSuffix = '/captcha.js';
-    var b64EncodedUrl = base64Utils.base64Encode(context.requestData.rawUrl);
+    var b64EncodedUrl = config.enableBlockedUrlOnCaptchaBlockPage
+        ? base64Utils.base64Encode(context.requestData.rawUrl)
+        : '';
+    var bParam = b64EncodedUrl && "&b=".concat(b64EncodedUrl);
     var b64HttpMethod = base64Utils.base64Encode(context.requestData.method);
-    var captchaParams = "?a=".concat(context.blockAction, "&u=").concat(context.uuid, "&v=").concat(context.vid || '', "&m=").concat(context.isMobile ? '1' : '0', "&b=").concat(b64EncodedUrl, "&h=").concat(b64HttpMethod);
+    var captchaParams = "?a=".concat(context.blockAction, "&u=").concat(context.uuid, "&v=").concat(context.vid || '', "&m=").concat(context.isMobile ? '1' : '0').concat(bParam, "&h=").concat(b64HttpMethod);
     var jsClientSrc = "".concat(config.backendClientUrl, "/").concat(config.appId, "/main.min.js");
     var blockScript = "".concat(config.backendCaptchaUrl, "/").concat(config.appId).concat(captchaScriptSuffix).concat(captchaParams);
     var hostUrl = config.backendCollectorUrl;

package/lib/cjs/config/ConfigurationBase.js CHANGED Viewed

@@ -54,6 +54,8 @@ var ConfigurationBase = /** @class */ (function () {
                 return (0, utils_1.isValidEnumValue)(logger_1.LoggerSeverity, params[key]);
             case 'px_module_mode':
                 return (0, utils_1.isValidEnumValue)(utils_1.ModuleMode, params[key]);
+            case 'px_cookie_secret':
+                return typeof params[key] === 'string' || Array.isArray(params[key]);
             default:
                 if (defaultParams[key] === null) {
                     return typeof params[key] === 'function';
@@ -135,6 +137,9 @@ var ConfigurationBase = /** @class */ (function () {
     });
     Object.defineProperty(ConfigurationBase.prototype, "cookieSecret", {
         get: function () {
+            if (typeof this.activeConfigParams.px_cookie_secret == 'string') {
+                return [this.activeConfigParams.px_cookie_secret];
+            }
             return this.activeConfigParams.px_cookie_secret;
         },
         enumerable: false,
@@ -695,6 +700,13 @@ var ConfigurationBase = /** @class */ (function () {
         enumerable: false,
         configurable: true
     });
+    Object.defineProperty(ConfigurationBase.prototype, "enableBlockedUrlOnCaptchaBlockPage", {
+        get: function () {
+            return true;
+        },
+        enumerable: false,
+        configurable: true
+    });
     return ConfigurationBase;
 }());
 exports.ConfigurationBase = ConfigurationBase;

package/lib/cjs/pxde/DefaultDataEnrichment.js CHANGED Viewed

@@ -39,6 +39,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DefaultDataEnrichment = void 0;
 var utils_1 = require("../utils");
 var constants_1 = require("./constants");
+var risk_token_1 = require("../risk_token");
 var DefaultDataEnrichment = /** @class */ (function () {
     function DefaultDataEnrichment(config, base64Utils, hmacUtils) {
         this.config = config;
@@ -97,20 +98,33 @@ var DefaultDataEnrichment = /** @class */ (function () {
     };
     DefaultDataEnrichment.prototype.verifyPxdeHmac = function (givenHmac, encodedPayload, context) {
         return __awaiter(this, void 0, void 0, function () {
-            var _a, e_2;
+            var index, _a, e_2;
             return __generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
-                        _b.trys.push([0, 2, , 3]);
-                        _a = givenHmac;
-                        return [4 /*yield*/, this.hmacUtils.createHmac(utils_1.Algorithm.SHA256, encodedPayload, this.config.cookieSecret)];
-                    case 1: return [2 /*return*/, (_a ===
-                            (_b.sent()))];
+                        index = 0;
+                        _b.label = 1;
+                    case 1:
+                        if (!(index < risk_token_1.COOKIE_SECRET_MAX_VALUES)) return [3 /*break*/, 6];
+                        _b.label = 2;
                     case 2:
+                        _b.trys.push([2, 4, , 5]);
+                        _a = givenHmac;
+                        return [4 /*yield*/, this.hmacUtils.createHmac(utils_1.Algorithm.SHA256, encodedPayload, this.config.cookieSecret[index])];
+                    case 3:
+                        if (_a ===
+                            (_b.sent())) {
+                            return [2 /*return*/, true];
+                        }
+                        return [3 /*break*/, 5];
+                    case 4:
                         e_2 = _b.sent();
                         context.logger.debug("failed verifying pxde hmac: ".concat(e_2));
-                        return [2 /*return*/, false];
-                    case 3: return [2 /*return*/];
+                        return [3 /*break*/, 5];
+                    case 5:
+                        index++;
+                        return [3 /*break*/, 1];
+                    case 6: return [2 /*return*/, false];
                 }
             });
         });

package/lib/cjs/risk_token/constants.js CHANGED Viewed

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COOKIE_V3_MAXIMUM_SALT_LENGTH = exports.COOKIE_V3_PARTS_COUNT = exports.COOKIE_V3_PAYLOAD_INDEX = exports.COOKIE_V3_ITERATIONS_INDEX = exports.COOKIE_V3_SALT_INDEX = exports.COOKIE_V3_HMAC_INDEX = exports.COOKIE_V3_NAME = exports.COOKIE_V2_NAME = exports.COOKIE_SPLIT_DELIMITER = void 0;
+exports.COOKIE_SECRET_MAX_VALUES = exports.COOKIE_V3_MAXIMUM_SALT_LENGTH = exports.COOKIE_V3_PARTS_COUNT = exports.COOKIE_V3_PAYLOAD_INDEX = exports.COOKIE_V3_ITERATIONS_INDEX = exports.COOKIE_V3_SALT_INDEX = exports.COOKIE_V3_HMAC_INDEX = exports.COOKIE_V3_NAME = exports.COOKIE_V2_NAME = exports.COOKIE_SPLIT_DELIMITER = void 0;
 exports.COOKIE_SPLIT_DELIMITER = ':';
 exports.COOKIE_V2_NAME = '_px2';
 exports.COOKIE_V3_NAME = '_px3';
@@ -10,3 +10,4 @@ exports.COOKIE_V3_ITERATIONS_INDEX = 2;
 exports.COOKIE_V3_PAYLOAD_INDEX = 3;
 exports.COOKIE_V3_PARTS_COUNT = 4;
 exports.COOKIE_V3_MAXIMUM_SALT_LENGTH = 100;
+exports.COOKIE_SECRET_MAX_VALUES = 2;

package/lib/cjs/risk_token/token/v2/DefaultTokenV2.js CHANGED Viewed

@@ -55,6 +55,7 @@ exports.DefaultTokenV2 = void 0;
 var blocker_1 = require("../../../blocker");
 var utils_1 = require("../../../utils");
 var TokenBase_1 = require("../TokenBase");
+var constants_1 = require("../../constants");
 var DefaultTokenV2 = /** @class */ (function (_super) {
     __extends(DefaultTokenV2, _super);
     function DefaultTokenV2(config, cookieString, base64Utils, hmacUtils) {
@@ -80,7 +81,7 @@ var DefaultTokenV2 = /** @class */ (function (_super) {
     };
     DefaultTokenV2.prototype.validate = function (context) {
         return __awaiter(this, void 0, void 0, function () {
-            var signingFields, passHmac, blockHmac, e_1;
+            var signingFields, index, passHmac, blockHmac, e_1;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -93,29 +94,38 @@ var DefaultTokenV2 = /** @class */ (function (_super) {
                         }
                         _a.label = 1;
                     case 1:
-                        _a.trys.push([1, 4, , 5]);
+                        _a.trys.push([1, 7, , 8]);
                         signingFields = this.getSigningFields(context);
-                        return [4 /*yield*/, this.calculateHmac(this.getHashParam('0', signingFields))];
+                        index = 0;
+                        _a.label = 2;
                     case 2:
+                        if (!(index < constants_1.COOKIE_SECRET_MAX_VALUES)) return [3 /*break*/, 6];
+                        return [4 /*yield*/, this.calculateHmac(this.getHashParam('0', signingFields), this.config.cookieSecret[index])];
+                    case 3:
                         passHmac = _a.sent();
                         if (passHmac === this.payload.h) {
                             this.isHighRisk = false;
                             return [2 /*return*/, true];
                         }
-                        return [4 /*yield*/, this.calculateHmac(this.getHashParam('1', signingFields))];
-                    case 3:
+                        return [4 /*yield*/, this.calculateHmac(this.getHashParam('1', signingFields), this.config.cookieSecret[index])];
+                    case 4:
                         blockHmac = _a.sent();
                         if (blockHmac === this.payload.h) {
                             this.isHighRisk = true;
                             return [2 /*return*/, true];
                         }
-                        context.logger.debug("unknown cookie v2 hmac (".concat(this.payload.h, "), does not match pass (").concat(passHmac, ") or block (").concat(blockHmac, ")"));
-                        return [3 /*break*/, 5];
-                    case 4:
+                        _a.label = 5;
+                    case 5:
+                        index++;
+                        return [3 /*break*/, 2];
+                    case 6:
+                        context.logger.debug("unknown cookie v2 hmac (".concat(this.payload.h, "), does not match pass or block hmac)"));
+                        return [3 /*break*/, 8];
+                    case 7:
                         e_1 = _a.sent();
                         context.logger.debug("cookie v2 validation caught error: ".concat(e_1));
-                        return [3 /*break*/, 5];
-                    case 5: return [2 /*return*/, false];
+                        return [3 /*break*/, 8];
+                    case 8: return [2 /*return*/, false];
                 }
             });
         });
@@ -134,12 +144,12 @@ var DefaultTokenV2 = /** @class */ (function (_super) {
         }
         return hashParam;
     };
-    DefaultTokenV2.prototype.calculateHmac = function (param) {
+    DefaultTokenV2.prototype.calculateHmac = function (param, cookieSecret) {
         return __awaiter(this, void 0, void 0, function () {
             var payload;
             return __generator(this, function (_a) {
                 payload = "".concat(this.payload.t).concat(this.payload.u).concat(this.payload.v).concat(param);
-                return [2 /*return*/, this.hmacUtils.createHmac(utils_1.Algorithm.SHA256, payload, this.cookieSecret)];
+                return [2 /*return*/, this.hmacUtils.createHmac(utils_1.Algorithm.SHA256, payload, cookieSecret)];
             });
         });
     };

package/lib/cjs/risk_token/token/v3/DefaultTokenV3.js CHANGED Viewed

@@ -56,6 +56,7 @@ var utils_1 = require("../../../utils");
 var constants_1 = require("../../constants");
 var TokenSignField_1 = require("./TokenSignField");
 var TokenBase_1 = require("../TokenBase");
+var activities_1 = require("../../../activities");
 var DefaultTokenV3 = /** @class */ (function (_super) {
     __extends(DefaultTokenV3, _super);
     function DefaultTokenV3(config, cookieString, cipherUtils, hmacUtils, isValidated, payload) {
@@ -64,6 +65,7 @@ var DefaultTokenV3 = /** @class */ (function (_super) {
         _this.maxIterations = config.riskCookieMaxIterations;
         _this.minIterations = config.riskCookieMinIterations;
         _this.blockingScore = config.blockingScore;
+        _this.cookieSecret = config.cookieSecret;
         _this.cookieString = cookieString;
         _this.cipherUtils = cipherUtils;
         _this.hmacUtils = hmacUtils;
@@ -71,11 +73,11 @@ var DefaultTokenV3 = /** @class */ (function (_super) {
     }
     DefaultTokenV3.prototype.decrypt = function (context) {
         return __awaiter(this, void 0, void 0, function () {
-            var data, salt, iterations, encryptedCookie, e_1;
+            var data, salt, iterations, encryptedCookie, index, payload, e_1;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        _a.trys.push([0, 2, , 3]);
+                        _a.trys.push([0, 5, , 6]);
                         data = this.cookieString.split(constants_1.COOKIE_SPLIT_DELIMITER);
                         if (data.length !== constants_1.COOKIE_V3_PARTS_COUNT) {
                             context.logger.debug("invalid cookie v3 structure: ".concat(data));
@@ -99,25 +101,43 @@ var DefaultTokenV3 = /** @class */ (function (_super) {
                             context.logger.debug("invalid cookie v3 encrypted payload: ".concat(encryptedCookie));
                             return [2 /*return*/, null];
                         }
-                        return [4 /*yield*/, this.decryptPayload(encryptedCookie, salt, iterations, context)];
-                    case 1: return [2 /*return*/, _a.sent()];
+                        index = 0;
+                        _a.label = 1;
+                    case 1:
+                        if (!(index < constants_1.COOKIE_SECRET_MAX_VALUES)) return [3 /*break*/, 4];
+                        context.logger.debug("Attempting to decrypt cookie using secret:  ".concat((0, activities_1.redactCookieSecret)(this.cookieSecret[index])));
+                        return [4 /*yield*/, this.decryptPayload(encryptedCookie, salt, iterations, this.cookieSecret[index], context)];
                     case 2:
+                        payload = _a.sent();
+                        if (payload) {
+                            context.logger.debug('Cookie decrypted successfully');
+                            this.usedCookieSecret = this.cookieSecret[index];
+                            // @ts-ignore
+                            context.usedCookieSecret = this.cookieSecret[index];
+                            return [2 /*return*/, payload];
+                        }
+                        _a.label = 3;
+                    case 3:
+                        index++;
+                        return [3 /*break*/, 1];
+                    case 4: return [3 /*break*/, 6];
+                    case 5:
                         e_1 = _a.sent();
                         context.logger.debug("cookie v3 decryption failed: ".concat(e_1));
-                        return [3 /*break*/, 3];
-                    case 3: return [2 /*return*/, null];
+                        return [3 /*break*/, 6];
+                    case 6: return [2 /*return*/, null];
                 }
             });
         });
     };
-    DefaultTokenV3.prototype.decryptPayload = function (encryptedCookie, salt, iterations, context) {
+    DefaultTokenV3.prototype.decryptPayload = function (encryptedCookie, salt, iterations, secret, context) {
         return __awaiter(this, void 0, void 0, function () {
             var decryptedCookie, payload, e_2;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         _a.trys.push([0, 2, , 3]);
-                        return [4 /*yield*/, this.cipherUtils.pbkdf2Decrypt(this.cookieSecret, encryptedCookie, iterations, salt)];
+                        return [4 /*yield*/, this.cipherUtils.pbkdf2Decrypt(secret, encryptedCookie, iterations, salt)];
                     case 1:
                         decryptedCookie = _a.sent();
                         if (!decryptedCookie) {
@@ -153,7 +173,7 @@ var DefaultTokenV3 = /** @class */ (function (_super) {
                         signedFields = this.getSignedWithFields(context);
                         hmacStrBase = this.cookieString.substring(this.cookieString.indexOf(constants_1.COOKIE_SPLIT_DELIMITER) + 1);
                         payload = "".concat(hmacStrBase).concat(signedFields.join(''));
-                        return [4 /*yield*/, this.hmacUtils.createHmac(utils_1.Algorithm.SHA256, payload, this.cookieSecret)];
+                        return [4 /*yield*/, this.hmacUtils.createHmac(utils_1.Algorithm.SHA256, payload, this.usedCookieSecret)];
                     case 1:
                         hash = _a.sent();
                         return [2 /*return*/, hash === this.hmac];

package/lib/cjs/utils/constants.js CHANGED Viewed

@@ -14,4 +14,4 @@ exports.PUSH_DATA_FEATURE_HEADER_NAME = 'x-px-feature';
 exports.EMAIL_ADDRESS_REGEX = /^[a-zA-Z0-9_+&*-]+(?:\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$/;
 exports.URL_REGEX = /^(https?\:)\/\/(([^@\s:]+):?([^@\s]*)@)?(([^:\/?#]*)(?:\:([0-9]+))?)([\/]{0,1}[^?#]*)(\?[^#]*|)(#.*|)$/;
 exports.REGEX_STRUCTURE = /^\/(.+?)\/([gimsuyvd]*)$/;
-exports.CORE_MODULE_VERSION = 'JS Core 0.21.3';
+exports.CORE_MODULE_VERSION = 'JS Core 0.21.5';

package/lib/cjs/utils/timestamp_hmac_header_validator/DefaultTimestampHmacHeaderValidator.js CHANGED Viewed

@@ -38,6 +38,7 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DefaultTimestampHmacHeaderValidator = void 0;
 var Algorithm_1 = require("../Algorithm");
+var risk_token_1 = require("../../risk_token");
 var TIMESTAMP_HMAC_HEADER_DELIMITER = ':';
 var TIMESTAMP_HMAC_HEADER_PARTS_COUNT = 2;
 var DefaultTimestampHmacHeaderValidator = /** @class */ (function () {
@@ -79,19 +80,37 @@ var DefaultTimestampHmacHeaderValidator = /** @class */ (function () {
     };
     DefaultTimestampHmacHeaderValidator.prototype.isHmacValid = function (givenHmac, timestamp, logger) {
         return __awaiter(this, void 0, void 0, function () {
-            var _a, err_1;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
+            var _a, index, _b, err_1;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
-                        _b.trys.push([0, 2, , 3]);
+                        _c.trys.push([0, 8, , 9]);
+                        if (!(typeof this.secret == 'string')) return [3 /*break*/, 2];
                         _a = givenHmac;
                         return [4 /*yield*/, this.hmacUtils.createHmac(Algorithm_1.Algorithm.SHA256, timestamp, this.secret)];
-                    case 1: return [2 /*return*/, _a === (_b.sent())];
+                    case 1: return [2 /*return*/, _a === (_c.sent())];
                     case 2:
-                        err_1 = _b.sent();
+                        index = 0;
+                        _c.label = 3;
+                    case 3:
+                        if (!(index < risk_token_1.COOKIE_SECRET_MAX_VALUES)) return [3 /*break*/, 6];
+                        _b = givenHmac;
+                        return [4 /*yield*/, this.hmacUtils.createHmac(Algorithm_1.Algorithm.SHA256, timestamp, this.secret[index])];
+                    case 4:
+                        if (_b === (_c.sent())) {
+                            return [2 /*return*/, true];
+                        }
+                        _c.label = 5;
+                    case 5:
+                        index++;
+                        return [3 /*break*/, 3];
+                    case 6: return [2 /*return*/, false];
+                    case 7: return [3 /*break*/, 9];
+                    case 8:
+                        err_1 = _c.sent();
                         logger.debug("caught error calculating timestamp:header hmac: ".concat(err_1));
                         return [2 /*return*/, false];
-                    case 3: return [2 /*return*/];
+                    case 9: return [2 /*return*/];
                 }
             });
         });

package/lib/esm/activities/utils.js CHANGED Viewed

@@ -67,7 +67,13 @@ export const addRootContextDataToDetails = (details, context) => {
         graphqlData: 'graphql_operations',
         enforcerStartTime: 'enforcer_start_time',
     });
+    if (context.usedCookieSecret) {
+        details.used_cookie_secret = redactCookieSecret(context.usedCookieSecret);
+    }
 };
+export function redactCookieSecret(secret) {
+    return '***'.concat(secret.substring(secret.length - 3, secret.length));
+}
 export const addConfigDataToDetails = (details, config) => {
     if (config.remoteConfigVersion) {
         details.remote_config_version = config.remoteConfigVersion;

package/lib/esm/blocker/utils.js CHANGED Viewed

@@ -12,9 +12,12 @@ export const renderHtml = (htmlTemplate, blockData) => {
 };
 export const createBlockData = (config, context, base64Utils) => {
     const captchaScriptSuffix = '/captcha.js';
-    const b64EncodedUrl = base64Utils.base64Encode(context.requestData.rawUrl);
+    const b64EncodedUrl = config.enableBlockedUrlOnCaptchaBlockPage
+        ? base64Utils.base64Encode(context.requestData.rawUrl)
+        : '';
+    const bParam = b64EncodedUrl && `&b=${b64EncodedUrl}`;
     const b64HttpMethod = base64Utils.base64Encode(context.requestData.method);
-    const captchaParams = `?a=${context.blockAction}&u=${context.uuid}&v=${context.vid || ''}&m=${context.isMobile ? '1' : '0'}&b=${b64EncodedUrl}&h=${b64HttpMethod}`;
+    const captchaParams = `?a=${context.blockAction}&u=${context.uuid}&v=${context.vid || ''}&m=${context.isMobile ? '1' : '0'}${bParam}&h=${b64HttpMethod}`;
     let jsClientSrc = `${config.backendClientUrl}/${config.appId}/main.min.js`;
     let blockScript = `${config.backendCaptchaUrl}/${config.appId}${captchaScriptSuffix}${captchaParams}`;
     let hostUrl = config.backendCollectorUrl;

package/lib/esm/config/ConfigurationBase.js CHANGED Viewed

@@ -44,6 +44,8 @@ export class ConfigurationBase {
                 return isValidEnumValue(LoggerSeverity, params[key]);
             case 'px_module_mode':
                 return isValidEnumValue(ModuleMode, params[key]);
+            case 'px_cookie_secret':
+                return typeof params[key] === 'string' || Array.isArray(params[key]);
             default:
                 if (defaultParams[key] === null) {
                     return typeof params[key] === 'function';
@@ -103,6 +105,9 @@ export class ConfigurationBase {
         return this.activeConfigParams.px_bypass_monitor_header;
     }
     get cookieSecret() {
+        if (typeof this.activeConfigParams.px_cookie_secret == 'string') {
+            return [this.activeConfigParams.px_cookie_secret];
+        }
         return this.activeConfigParams.px_cookie_secret;
     }
     get customCookieHeader() {
@@ -342,4 +347,7 @@ export class ConfigurationBase {
     get securedPxhdEnabled() {
         return this.activeConfigParams.px_secured_pxhd_enabled;
     }
+    get enableBlockedUrlOnCaptchaBlockPage() {
+        return true;
+    }
 }

package/lib/esm/context/DefaultContext.js CHANGED Viewed

@@ -32,6 +32,7 @@ export class DefaultContext {
     response;
     enforcerStartTime;
     logger;
+    usedCookieSecret;
     config;
     urlUtils;
     constructor(config, request, options) {

package/lib/esm/pxde/DefaultDataEnrichment.js CHANGED Viewed

@@ -1,5 +1,6 @@
 import { Algorithm, PXDE_COOKIE_NAME } from '../utils';
 import { PXDE_COOKIE_DELIMITER, PXDE_COOKIE_PARTS_COUNT, PXDE_HMAC_INDEX, PXDE_PAYLOAD_INDEX } from './constants';
+import { COOKIE_SECRET_MAX_VALUES } from '../risk_token';
 export class DefaultDataEnrichment {
     config;
     base64Utils;
@@ -39,14 +40,18 @@ export class DefaultDataEnrichment {
         };
     }
     async verifyPxdeHmac(givenHmac, encodedPayload, context) {
-        try {
-            return (givenHmac ===
-                (await this.hmacUtils.createHmac(Algorithm.SHA256, encodedPayload, this.config.cookieSecret)));
-        }
-        catch (e) {
-            context.logger.debug(`failed verifying pxde hmac: ${e}`);
-            return false;
+        for (let index = 0; index < COOKIE_SECRET_MAX_VALUES; index++) {
+            try {
+                if (givenHmac ===
+                    (await this.hmacUtils.createHmac(Algorithm.SHA256, encodedPayload, this.config.cookieSecret[index]))) {
+                    return true;
+                }
+            }
+            catch (e) {
+                context.logger.debug(`failed verifying pxde hmac: ${e}`);
+            }
         }
+        return false;
     }
     async parsePxdePayload(encodedPayload, context) {
         try {

package/lib/esm/risk_token/constants.js CHANGED Viewed

@@ -7,3 +7,4 @@ export const COOKIE_V3_ITERATIONS_INDEX = 2;
 export const COOKIE_V3_PAYLOAD_INDEX = 3;
 export const COOKIE_V3_PARTS_COUNT = 4;
 export const COOKIE_V3_MAXIMUM_SALT_LENGTH = 100;
+export const COOKIE_SECRET_MAX_VALUES = 2;

package/lib/esm/risk_token/token/serialize/SerializedToken.js CHANGED Viewed

@@ -10,6 +10,7 @@ export class SerializedToken {
     tokenString;
     uuid;
     vid;
+    usedCookieSecret;
     blockingScore;
     constructor(config, serializedToken) {
         this.blockingScore = config.blockingScore;

package/lib/esm/risk_token/token/v2/DefaultTokenV2.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { BlockAction } from '../../../blocker';
 import { Algorithm, isValidUuid } from '../../../utils';
 import { TokenBase } from '../TokenBase';
+import { COOKIE_SECRET_MAX_VALUES } from '../../constants';
 export class DefaultTokenV2 extends TokenBase {
     base64Utils;
     hmacUtils;
@@ -35,17 +36,19 @@ export class DefaultTokenV2 extends TokenBase {
         }
         try {
             const signingFields = this.getSigningFields(context);
-            const passHmac = await this.calculateHmac(this.getHashParam('0', signingFields));
-            if (passHmac === this.payload.h) {
-                this.isHighRisk = false;
-                return true;
+            for (let index = 0; index < COOKIE_SECRET_MAX_VALUES; index++) {
+                const passHmac = await this.calculateHmac(this.getHashParam('0', signingFields), this.config.cookieSecret[index]);
+                if (passHmac === this.payload.h) {
+                    this.isHighRisk = false;
+                    return true;
+                }
+                const blockHmac = await this.calculateHmac(this.getHashParam('1', signingFields), this.config.cookieSecret[index]);
+                if (blockHmac === this.payload.h) {
+                    this.isHighRisk = true;
+                    return true;
+                }
             }
-            const blockHmac = await this.calculateHmac(this.getHashParam('1', signingFields));
-            if (blockHmac === this.payload.h) {
-                this.isHighRisk = true;
-                return true;
-            }
-            context.logger.debug(`unknown cookie v2 hmac (${this.payload.h}), does not match pass (${passHmac}) or block (${blockHmac})`);
+            context.logger.debug(`unknown cookie v2 hmac (${this.payload.h}), does not match pass or block hmac)`);
         }
         catch (e) {
             context.logger.debug(`cookie v2 validation caught error: ${e}`);
@@ -66,9 +69,9 @@ export class DefaultTokenV2 extends TokenBase {
         }
         return hashParam;
     }
-    async calculateHmac(param) {
+    async calculateHmac(param, cookieSecret) {
         const payload = `${this.payload.t}${this.payload.u}${this.payload.v}${param}`;
-        return this.hmacUtils.createHmac(Algorithm.SHA256, payload, this.cookieSecret);
+        return this.hmacUtils.createHmac(Algorithm.SHA256, payload, cookieSecret);
     }
     isExpired() {
         return Date.now() > this.payload?.t;

package/lib/esm/risk_token/token/v3/DefaultTokenV3.js CHANGED Viewed

@@ -1,7 +1,8 @@
 import { Algorithm } from '../../../utils';
-import { COOKIE_SPLIT_DELIMITER, COOKIE_V3_HMAC_INDEX, COOKIE_V3_ITERATIONS_INDEX, COOKIE_V3_MAXIMUM_SALT_LENGTH, COOKIE_V3_PARTS_COUNT, COOKIE_V3_PAYLOAD_INDEX, COOKIE_V3_SALT_INDEX, } from '../../constants';
+import { COOKIE_SECRET_MAX_VALUES, COOKIE_SPLIT_DELIMITER, COOKIE_V3_HMAC_INDEX, COOKIE_V3_ITERATIONS_INDEX, COOKIE_V3_MAXIMUM_SALT_LENGTH, COOKIE_V3_PARTS_COUNT, COOKIE_V3_PAYLOAD_INDEX, COOKIE_V3_SALT_INDEX, } from '../../constants';
 import { TokenSignField } from './TokenSignField';
 import { TokenBase } from '../TokenBase';
+import { redactCookieSecret } from '../../../activities';
 export class DefaultTokenV3 extends TokenBase {
     maxIterations;
     minIterations;
@@ -9,11 +10,13 @@ export class DefaultTokenV3 extends TokenBase {
     cipherUtils;
     hmacUtils;
     hash;
+    usedCookieSecret;
     constructor(config, cookieString, cipherUtils, hmacUtils, isValidated = false, payload) {
         super(config, cookieString, isValidated, payload);
         this.maxIterations = config.riskCookieMaxIterations;
         this.minIterations = config.riskCookieMinIterations;
         this.blockingScore = config.blockingScore;
+        this.cookieSecret = config.cookieSecret;
         this.cookieString = cookieString;
         this.cipherUtils = cipherUtils;
         this.hmacUtils = hmacUtils;
@@ -43,16 +46,26 @@ export class DefaultTokenV3 extends TokenBase {
                 context.logger.debug(`invalid cookie v3 encrypted payload: ${encryptedCookie}`);
                 return null;
             }
-            return await this.decryptPayload(encryptedCookie, salt, iterations, context);
+            for (let index = 0; index < COOKIE_SECRET_MAX_VALUES; index++) {
+                context.logger.debug(`Attempting to decrypt cookie using secret:  ${redactCookieSecret(this.cookieSecret[index])}`);
+                const payload = await this.decryptPayload(encryptedCookie, salt, iterations, this.cookieSecret[index], context);
+                if (payload) {
+                    context.logger.debug('Cookie decrypted successfully');
+                    this.usedCookieSecret = this.cookieSecret[index];
+                    // @ts-ignore
+                    context.usedCookieSecret = this.cookieSecret[index];
+                    return payload;
+                }
+            }
         }
         catch (e) {
             context.logger.debug(`cookie v3 decryption failed: ${e}`);
         }
         return null;
     }
-    async decryptPayload(encryptedCookie, salt, iterations, context) {
+    async decryptPayload(encryptedCookie, salt, iterations, secret, context) {
         try {
-            const decryptedCookie = await this.cipherUtils.pbkdf2Decrypt(this.cookieSecret, encryptedCookie, iterations, salt);
+            const decryptedCookie = await this.cipherUtils.pbkdf2Decrypt(secret, encryptedCookie, iterations, salt);
             if (!decryptedCookie) {
                 context.logger.debug(`cookie v3 decryption returned falsy value: ${decryptedCookie}`);
                 return null;
@@ -78,7 +91,7 @@ export class DefaultTokenV3 extends TokenBase {
             const signedFields = this.getSignedWithFields(context);
             const hmacStrBase = this.cookieString.substring(this.cookieString.indexOf(COOKIE_SPLIT_DELIMITER) + 1);
             const payload = `${hmacStrBase}${signedFields.join('')}`;
-            const hash = await this.hmacUtils.createHmac(Algorithm.SHA256, payload, this.cookieSecret);
+            const hash = await this.hmacUtils.createHmac(Algorithm.SHA256, payload, this.usedCookieSecret);
             return hash === this.hmac;
         }
         catch (e) {

package/lib/esm/utils/constants.js CHANGED Viewed

@@ -11,4 +11,4 @@ export const PUSH_DATA_FEATURE_HEADER_NAME = 'x-px-feature';
 export const EMAIL_ADDRESS_REGEX = /^[a-zA-Z0-9_+&*-]+(?:\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$/;
 export const URL_REGEX = /^(https?\:)\/\/(([^@\s:]+):?([^@\s]*)@)?(([^:\/?#]*)(?:\:([0-9]+))?)([\/]{0,1}[^?#]*)(\?[^#]*|)(#.*|)$/;
 export const REGEX_STRUCTURE = /^\/(.+?)\/([gimsuyvd]*)$/;
-export const CORE_MODULE_VERSION = 'JS Core 0.21.3';
+export const CORE_MODULE_VERSION = 'JS Core 0.21.5';

package/lib/esm/utils/timestamp_hmac_header_validator/DefaultTimestampHmacHeaderValidator.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import { Algorithm } from '../Algorithm';
+import { COOKIE_SECRET_MAX_VALUES } from '../../risk_token';
 const TIMESTAMP_HMAC_HEADER_DELIMITER = ':';
 const TIMESTAMP_HMAC_HEADER_PARTS_COUNT = 2;
 export class DefaultTimestampHmacHeaderValidator {
@@ -34,7 +35,17 @@ export class DefaultTimestampHmacHeaderValidator {
     }
     async isHmacValid(givenHmac, timestamp, logger) {
         try {
-            return givenHmac === (await this.hmacUtils.createHmac(Algorithm.SHA256, timestamp, this.secret));
+            if (typeof this.secret == 'string') {
+                return givenHmac === (await this.hmacUtils.createHmac(Algorithm.SHA256, timestamp, this.secret));
+            }
+            else {
+                for (let index = 0; index < COOKIE_SECRET_MAX_VALUES; index++) {
+                    if (givenHmac === (await this.hmacUtils.createHmac(Algorithm.SHA256, timestamp, this.secret[index]))) {
+                        return true;
+                    }
+                }
+                return false;
+            }
         }
         catch (err) {
             logger.debug(`caught error calculating timestamp:header hmac: ${err}`);

package/lib/types/activities/model/CommonActivityDetails.d.ts CHANGED Viewed

@@ -41,4 +41,5 @@ export type CommonActivityDetails = {
     remote_config_version?: number;
     enforcer_start_time: number;
     raw_url?: string;
+    used_cookie_secret?: string;
 } & CustomParameters;

package/lib/types/activities/utils.d.ts CHANGED Viewed

@@ -225,6 +225,7 @@ export declare const createAsyncActivity: <Req, Res>(activityType: ActivityType,
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("../risk_token").TokenOrigin;
                 readonly score?: number;
@@ -452,6 +453,7 @@ export declare const createAsyncActivity: <Req, Res>(activityType: ActivityType,
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("../risk_token").TokenOrigin;
                     readonly score?: number;
@@ -611,6 +613,7 @@ export declare const createAsyncActivity: <Req, Res>(activityType: ActivityType,
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("../risk_token").TokenOrigin;
     readonly score?: number;
@@ -894,6 +897,7 @@ export declare const createActivityDetails: <Req, Res>(activityType: ActivityTyp
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("../risk_token").TokenOrigin;
                 readonly score?: number;
@@ -1121,6 +1125,7 @@ export declare const createActivityDetails: <Req, Res>(activityType: ActivityTyp
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("../risk_token").TokenOrigin;
                     readonly score?: number;
@@ -1280,6 +1285,7 @@ export declare const createActivityDetails: <Req, Res>(activityType: ActivityTyp
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("../risk_token").TokenOrigin;
     readonly score?: number;
@@ -1563,6 +1569,7 @@ export declare const createAsyncActivityCommonDetails: <Req, Res>(context: {
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("../risk_token").TokenOrigin;
                 readonly score?: number;
@@ -1790,6 +1797,7 @@ export declare const createAsyncActivityCommonDetails: <Req, Res>(context: {
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("../risk_token").TokenOrigin;
                     readonly score?: number;
@@ -1949,6 +1957,7 @@ export declare const createAsyncActivityCommonDetails: <Req, Res>(context: {
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("../risk_token").TokenOrigin;
     readonly score?: number;
@@ -2232,6 +2241,7 @@ export declare const createCommonActivityDetails: <Req, Res>(config: IConfigurat
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("../risk_token").TokenOrigin;
                 readonly score?: number;
@@ -2459,6 +2469,7 @@ export declare const createCommonActivityDetails: <Req, Res>(config: IConfigurat
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("../risk_token").TokenOrigin;
                     readonly score?: number;
@@ -2618,6 +2629,7 @@ export declare const createCommonActivityDetails: <Req, Res>(config: IConfigurat
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("../risk_token").TokenOrigin;
     readonly score?: number;
@@ -2901,6 +2913,7 @@ export declare const addRootContextDataToDetails: <Req, Res>(details: CommonActi
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("../risk_token").TokenOrigin;
                 readonly score?: number;
@@ -3128,6 +3141,7 @@ export declare const addRootContextDataToDetails: <Req, Res>(details: CommonActi
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("../risk_token").TokenOrigin;
                     readonly score?: number;
@@ -3287,6 +3301,7 @@ export declare const addRootContextDataToDetails: <Req, Res>(details: CommonActi
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("../risk_token").TokenOrigin;
     readonly score?: number;
@@ -3352,6 +3367,7 @@ export declare const addRootContextDataToDetails: <Req, Res>(details: CommonActi
     readonly isRemoteConfigUpdateRequest: boolean;
     readonly enforcerStartTime?: number;
 }) => void;
+export declare function redactCookieSecret(secret: string): string;
 export declare const addConfigDataToDetails: <Req, Res>(details: CommonActivityDetails, config: IConfiguration<Req, Res, import("../config").ConfigurationParams<Req, Res>>) => void;
 export declare const addCustomParametersToDetails: (details: CommonActivityDetails, customParameters: CustomParameters) => void;
 export declare const addProductDataToDetails: (details: CommonActivityDetails, productData: DeepReadonly<ProductData>) => void;
@@ -3627,6 +3643,7 @@ export declare const addRiskApiDataToAsyncActivityCommonDetails: <Req, Res>(deta
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("../risk_token").TokenOrigin;
                 readonly score?: number;
@@ -3854,6 +3871,7 @@ export declare const addRiskApiDataToAsyncActivityCommonDetails: <Req, Res>(deta
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("../risk_token").TokenOrigin;
                     readonly score?: number;
@@ -4013,6 +4031,7 @@ export declare const addRiskApiDataToAsyncActivityCommonDetails: <Req, Res>(deta
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("../risk_token").TokenOrigin;
     readonly score?: number;
@@ -4296,6 +4315,7 @@ export declare const addResponseDataToAsyncActivityCommonDetails: <Req, Res>(det
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("../risk_token").TokenOrigin;
                 readonly score?: number;
@@ -4523,6 +4543,7 @@ export declare const addResponseDataToAsyncActivityCommonDetails: <Req, Res>(det
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("../risk_token").TokenOrigin;
                     readonly score?: number;
@@ -4682,6 +4703,7 @@ export declare const addResponseDataToAsyncActivityCommonDetails: <Req, Res>(det
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("../risk_token").TokenOrigin;
     readonly score?: number;
@@ -4965,6 +4987,7 @@ export declare const createPageRequestedActivityDetails: <Req, Res>(context: {
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("../risk_token").TokenOrigin;
                 readonly score?: number;
@@ -5192,6 +5215,7 @@ export declare const createPageRequestedActivityDetails: <Req, Res>(context: {
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("../risk_token").TokenOrigin;
                     readonly score?: number;
@@ -5351,6 +5375,7 @@ export declare const createPageRequestedActivityDetails: <Req, Res>(context: {
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("../risk_token").TokenOrigin;
     readonly score?: number;
@@ -5634,6 +5659,7 @@ export declare const createBlockActivityDetails: <Req, Res>(context: {
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("../risk_token").TokenOrigin;
                 readonly score?: number;
@@ -5861,6 +5887,7 @@ export declare const createBlockActivityDetails: <Req, Res>(context: {
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("../risk_token").TokenOrigin;
                     readonly score?: number;
@@ -6020,6 +6047,7 @@ export declare const createBlockActivityDetails: <Req, Res>(context: {
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("../risk_token").TokenOrigin;
     readonly score?: number;
@@ -6303,6 +6331,7 @@ export declare const createAdditionalS2SActivityDetails: <Req, Res>({ ciSendRawU
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("../risk_token").TokenOrigin;
                 readonly score?: number;
@@ -6530,6 +6559,7 @@ export declare const createAdditionalS2SActivityDetails: <Req, Res>({ ciSendRawU
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("../risk_token").TokenOrigin;
                     readonly score?: number;
@@ -6689,6 +6719,7 @@ export declare const createAdditionalS2SActivityDetails: <Req, Res>({ ciSendRawU
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("../risk_token").TokenOrigin;
     readonly score?: number;

package/lib/types/blocker/utils.d.ts CHANGED Viewed

@@ -221,6 +221,7 @@ export declare const createBlockData: <Req, Res>(config: IConfiguration<Req, Res
                 };
                 readonly uuid: string;
                 readonly vid?: string;
+                readonly usedCookieSecret?: string;
                 readonly vidSource?: import("../utils").VidSource;
                 readonly tokenOrigin: import("..").TokenOrigin;
                 readonly score?: number;
@@ -448,6 +449,7 @@ export declare const createBlockData: <Req, Res>(config: IConfiguration<Req, Res
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("..").TokenOrigin;
                     readonly score?: number;
@@ -607,6 +609,7 @@ export declare const createBlockData: <Req, Res>(config: IConfiguration<Req, Res
     };
     readonly uuid: string;
     readonly vid?: string;
+    readonly usedCookieSecret?: string;
     readonly vidSource?: import("../utils").VidSource;
     readonly tokenOrigin: import("..").TokenOrigin;
     readonly score?: number;

package/lib/types/config/ConfigurationBase.d.ts CHANGED Viewed

@@ -32,7 +32,7 @@ export declare abstract class ConfigurationBase<Req, Res, ParamsType extends Con
     get authToken(): string;
     get blockingScore(): number;
     get bypassMonitorHeader(): string;
-    get cookieSecret(): string;
+    get cookieSecret(): string[];
     get customCookieHeader(): string;
     get customLogo(): string;
     get enforcedRoutes(): Array<string | RegExp>;
@@ -112,4 +112,5 @@ export declare abstract class ConfigurationBase<Req, Res, ParamsType extends Con
     get remoteConfigMaxFetchAttempts(): number;
     get urlDecodeReservedCharacters(): boolean;
     get securedPxhdEnabled(): boolean;
+    get enableBlockedUrlOnCaptchaBlockPage(): boolean;
 }

package/lib/types/config/IConfiguration.d.ts CHANGED Viewed

@@ -15,7 +15,7 @@ export interface IConfiguration<Req, Res, ParamsType extends ConfigurationParams
     /**
      * The cookie secret used to decrypt the risk cookie.
      */
-    readonly cookieSecret: string;
+    readonly cookieSecret: string[];
     /**
      * The token used to authenticate with the Human/PerimeterX backend.
      */
@@ -369,6 +369,10 @@ export interface IConfiguration<Req, Res, ParamsType extends ConfigurationParams
      * Whether to add the Secure attribute when setting the PXHD cookie.
      */
     readonly securedPxhdEnabled: boolean;
+    /**
+     * Whether to include the request url in captcha block page
+     */
+    readonly enableBlockedUrlOnCaptchaBlockPage: boolean;
     /**
      * Returns an object representation of the current configuration.
      */

package/lib/types/config/params/StaticConfigurationParamsOnly.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 export type StaticConfigurationParamsOnly = {
     px_app_id: string;
-    px_cookie_secret: string;
+    px_cookie_secret: string | string[];
     px_auth_token: string;
     px_logger_auth_token?: string;
     px_remote_config_auth_token?: string;

package/lib/types/context/DefaultContext.d.ts CHANGED Viewed

@@ -43,6 +43,7 @@ export declare class DefaultContext<Req, Res> implements IContext<Req, Res> {
     response?: IOutgoingResponse<Res>;
     enforcerStartTime?: number;
     logger: ILogger;
+    usedCookieSecret?: string;
     protected readonly config: IConfiguration<Req, Res>;
     protected readonly urlUtils: IUrlUtils;
     constructor(config: IConfiguration<Req, Res>, request: IIncomingRequest<Req>, options: DefaultContextOptions);

package/lib/types/context/interfaces/IContext.d.ts CHANGED Viewed

@@ -59,6 +59,10 @@ export interface IContext<Req, Res> {
      * The visitor ID, unique to the end-user.
      */
     vid?: string;
+    /**
+     * The secret used to decrypt the risk cookie.
+     */
+    usedCookieSecret?: string;
     /**
      * A string representing where the visitor ID was obtained.
      */

package/lib/types/monitored_request/MonitoredRequestUtils.d.ts CHANGED Viewed

@@ -221,6 +221,7 @@ export declare namespace MonitoredRequestUtils {
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("..").TokenOrigin;
                     readonly score?: number;
@@ -448,6 +449,7 @@ export declare namespace MonitoredRequestUtils {
                         };
                         readonly uuid: string;
                         readonly vid?: string;
+                        readonly usedCookieSecret?: string;
                         readonly vidSource?: import("../utils").VidSource;
                         readonly tokenOrigin: import("..").TokenOrigin;
                         readonly score?: number;
@@ -607,6 +609,7 @@ export declare namespace MonitoredRequestUtils {
         };
         readonly uuid: string;
         readonly vid?: string;
+        readonly usedCookieSecret?: string;
         readonly vidSource?: import("../utils").VidSource;
         readonly tokenOrigin: import("..").TokenOrigin;
         readonly score?: number;
@@ -892,6 +895,7 @@ export declare namespace MonitoredRequestUtils {
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("..").TokenOrigin;
                     readonly score?: number;
@@ -1119,6 +1123,7 @@ export declare namespace MonitoredRequestUtils {
                         };
                         readonly uuid: string;
                         readonly vid?: string;
+                        readonly usedCookieSecret?: string;
                         readonly vidSource?: import("../utils").VidSource;
                         readonly tokenOrigin: import("..").TokenOrigin;
                         readonly score?: number;
@@ -1278,6 +1283,7 @@ export declare namespace MonitoredRequestUtils {
         };
         readonly uuid: string;
         readonly vid?: string;
+        readonly usedCookieSecret?: string;
         readonly vidSource?: import("../utils").VidSource;
         readonly tokenOrigin: import("..").TokenOrigin;
         readonly score?: number;
@@ -1561,6 +1567,7 @@ export declare namespace MonitoredRequestUtils {
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("..").TokenOrigin;
                     readonly score?: number;
@@ -1788,6 +1795,7 @@ export declare namespace MonitoredRequestUtils {
                         };
                         readonly uuid: string;
                         readonly vid?: string;
+                        readonly usedCookieSecret?: string;
                         readonly vidSource?: import("../utils").VidSource;
                         readonly tokenOrigin: import("..").TokenOrigin;
                         readonly score?: number;
@@ -1947,6 +1955,7 @@ export declare namespace MonitoredRequestUtils {
         };
         readonly uuid: string;
         readonly vid?: string;
+        readonly usedCookieSecret?: string;
         readonly vidSource?: import("../utils").VidSource;
         readonly tokenOrigin: import("..").TokenOrigin;
         readonly score?: number;

package/lib/types/pxhd/PXHDUtils.d.ts CHANGED Viewed

@@ -223,6 +223,7 @@ export declare namespace PXHDUtils {
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("..").TokenOrigin;
                     readonly score?: number;
@@ -450,6 +451,7 @@ export declare namespace PXHDUtils {
                         };
                         readonly uuid: string;
                         readonly vid?: string;
+                        readonly usedCookieSecret?: string;
                         readonly vidSource?: import("../utils").VidSource;
                         readonly tokenOrigin: import("..").TokenOrigin;
                         readonly score?: number;
@@ -609,6 +611,7 @@ export declare namespace PXHDUtils {
         };
         readonly uuid: string;
         readonly vid?: string;
+        readonly usedCookieSecret?: string;
         readonly vidSource?: import("../utils").VidSource;
         readonly tokenOrigin: import("..").TokenOrigin;
         readonly score?: number;
@@ -892,6 +895,7 @@ export declare namespace PXHDUtils {
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("..").TokenOrigin;
                     readonly score?: number;
@@ -1119,6 +1123,7 @@ export declare namespace PXHDUtils {
                         };
                         readonly uuid: string;
                         readonly vid?: string;
+                        readonly usedCookieSecret?: string;
                         readonly vidSource?: import("../utils").VidSource;
                         readonly tokenOrigin: import("..").TokenOrigin;
                         readonly score?: number;
@@ -1278,6 +1283,7 @@ export declare namespace PXHDUtils {
         };
         readonly uuid: string;
         readonly vid?: string;
+        readonly usedCookieSecret?: string;
         readonly vidSource?: import("../utils").VidSource;
         readonly tokenOrigin: import("..").TokenOrigin;
         readonly score?: number;

package/lib/types/risk_token/constants.d.ts CHANGED Viewed

@@ -7,3 +7,4 @@ export declare const COOKIE_V3_ITERATIONS_INDEX = 2;
 export declare const COOKIE_V3_PAYLOAD_INDEX = 3;
 export declare const COOKIE_V3_PARTS_COUNT = 4;
 export declare const COOKIE_V3_MAXIMUM_SALT_LENGTH = 100;
+export declare const COOKIE_SECRET_MAX_VALUES = 2;

package/lib/types/risk_token/token/TokenBase.d.ts CHANGED Viewed

@@ -6,7 +6,7 @@ import { BlockAction } from '../../blocker';
 import { IConfiguration } from '../../config';
 import { TokenPayloadType } from './TokenPayloadType';
 import { TokenVersion } from '../TokenVersion';
-import { TokenJson } from './serialize/TokenJson';
+import { TokenJson } from './serialize';
 export declare abstract class TokenBase<TokenV extends TokenVersion, Req, Res> implements IToken<Req, Res> {
     abstract readonly action: BlockAction;
     abstract readonly hmac: string;
@@ -22,7 +22,7 @@ export declare abstract class TokenBase<TokenV extends TokenVersion, Req, Res> i
     protected readonly config: IConfiguration<Req, Res>;
     protected payload: TokenPayloadType<TokenV>;
     protected cookieString: string;
-    protected cookieSecret: string;
+    protected cookieSecret: string[];
     protected cookieMaxLength: number;
     isValidated: boolean;
     protected constructor(config: IConfiguration<Req, Res>, cookieString: string, isValidated?: boolean, payload?: TokenPayloadType<TokenV>);

package/lib/types/risk_token/token/serialize/SerializedToken.d.ts CHANGED Viewed

@@ -15,6 +15,7 @@ export declare class SerializedToken<Req, Res> implements IToken<Res, Res> {
     readonly tokenString: string;
     readonly uuid: string;
     readonly vid: string;
+    readonly usedCookieSecret: string;
     protected readonly blockingScore: number;
     constructor(config: IConfiguration<Req, Res>, serializedToken: TokenJson);
     isExpired(): boolean;

package/lib/types/risk_token/token/v3/DefaultTokenV3.d.ts CHANGED Viewed

@@ -13,9 +13,10 @@ export declare class DefaultTokenV3<Req, Res> extends TokenBase<TokenVersion.V3,
     protected readonly cipherUtils: ICipherUtils;
     protected readonly hmacUtils: IHmacUtils;
     protected hash: string;
+    protected usedCookieSecret: string;
     constructor(config: IConfiguration<Req, Res>, cookieString: string, cipherUtils: ICipherUtils, hmacUtils: IHmacUtils, isValidated?: boolean, payload?: TokenV3Payload);
     protected decrypt(context: ReadonlyContext<Req, Res>): Promise<TokenV3Payload>;
-    protected decryptPayload(encryptedCookie: string, salt: string, iterations: number, context: ReadonlyContext<Req, Res>): Promise<TokenV3Payload>;
+    protected decryptPayload(encryptedCookie: string, salt: string, iterations: number, secret: string, context: ReadonlyContext<Req, Res>): Promise<TokenV3Payload>;
     protected validate(context: ReadonlyContext<Req, Res>): Promise<boolean>;
     protected getSignedWithFields(context: ReadonlyContext<Req, Res>): string[];
     protected getSignedWithField(char: TokenSignField, { requestData }: ReadonlyContext<Req, Res>): string;

package/lib/types/sensitive_request/SensitiveRequestUtils.d.ts CHANGED Viewed

@@ -222,6 +222,7 @@ export declare namespace SensitiveRequestUtils {
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("..").TokenOrigin;
                     readonly score?: number;
@@ -449,6 +450,7 @@ export declare namespace SensitiveRequestUtils {
                         };
                         readonly uuid: string;
                         readonly vid?: string;
+                        readonly usedCookieSecret?: string;
                         readonly vidSource?: import("../utils").VidSource;
                         readonly tokenOrigin: import("..").TokenOrigin;
                         readonly score?: number;
@@ -608,6 +610,7 @@ export declare namespace SensitiveRequestUtils {
         };
         readonly uuid: string;
         readonly vid?: string;
+        readonly usedCookieSecret?: string;
         readonly vidSource?: import("../utils").VidSource;
         readonly tokenOrigin: import("..").TokenOrigin;
         readonly score?: number;
@@ -893,6 +896,7 @@ export declare namespace SensitiveRequestUtils {
                     };
                     readonly uuid: string;
                     readonly vid?: string;
+                    readonly usedCookieSecret?: string;
                     readonly vidSource?: import("../utils").VidSource;
                     readonly tokenOrigin: import("..").TokenOrigin;
                     readonly score?: number;
@@ -1120,6 +1124,7 @@ export declare namespace SensitiveRequestUtils {
                         };
                         readonly uuid: string;
                         readonly vid?: string;
+                        readonly usedCookieSecret?: string;
                         readonly vidSource?: import("../utils").VidSource;
                         readonly tokenOrigin: import("..").TokenOrigin;
                         readonly score?: number;
@@ -1279,6 +1284,7 @@ export declare namespace SensitiveRequestUtils {
         };
         readonly uuid: string;
         readonly vid?: string;
+        readonly usedCookieSecret?: string;
         readonly vidSource?: import("../utils").VidSource;
         readonly tokenOrigin: import("..").TokenOrigin;
         readonly score?: number;

package/lib/types/utils/constants.d.ts CHANGED Viewed

@@ -11,4 +11,4 @@ export declare const PUSH_DATA_FEATURE_HEADER_NAME = "x-px-feature";
 export declare const EMAIL_ADDRESS_REGEX: RegExp;
 export declare const URL_REGEX: RegExp;
 export declare const REGEX_STRUCTURE: RegExp;
-export declare const CORE_MODULE_VERSION = "JS Core 0.21.3";
+export declare const CORE_MODULE_VERSION = "JS Core 0.21.5";

package/lib/types/utils/timestamp_hmac_header_validator/DefaultTimestampHmacHeaderValidator.d.ts CHANGED Viewed

@@ -5,10 +5,10 @@ import { IHmacUtils } from '../hmac';
 import { ITimestampHmacHeaderValidator } from './ITimestampHmacHeaderValidator';
 export declare class DefaultTimestampHmacHeaderValidator<Req, Res> implements ITimestampHmacHeaderValidator {
     protected readonly config: IConfiguration<Req, Res>;
-    protected readonly secret: string;
+    protected readonly secret: string[] | string;
     protected readonly base64Utils: IBase64Utils;
     protected readonly hmacUtils: IHmacUtils;
-    constructor(config: IConfiguration<Req, Res>, secret: string, base64Utils: IBase64Utils, hmacUtils: IHmacUtils);
+    constructor(config: IConfiguration<Req, Res>, secret: string[] | string, base64Utils: IBase64Utils, hmacUtils: IHmacUtils);
     isValid(headerValue: string, logger: ILogger): Promise<boolean>;
     protected isHmacValid(givenHmac: string, timestamp: string, logger: ILogger): Promise<boolean>;
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "perimeterx-js-core",
-  "version": "0.21.3",
+  "version": "0.21.5",
   "description": "",
   "type": "module",
   "typesVersions": {