perimeterx-js-core 0.7.1 → 0.9.0

package/lib/esm/phase/impl/DecideActionPhase.js

@@ -0,0 +1,19 @@
+import { LoggerSeverity } from '../../logger';
+import { getDecisionFromContext } from '../../action';
+export class DecideActionPhase {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async updateContextDecision(context) {
+        const { action, reasons } = getDecisionFromContext(context);
+        if (this.config.logger.getLoggerSeverity() === LoggerSeverity.DEBUG) {
+            const productReasons = Object.entries(reasons)
+                .map(([prod, reason]) => `${prod} -> ${reason}`)
+                .join(', ');
+            this.config.logger.debug(`decision: ${action}, reasons: ${productReasons}`);
+        }
+        context.action = action;
+        context.reasons = reasons;
+    }
+}

package/lib/esm/phase/impl/EnrichContextFromRequestPhase.js

@@ -0,0 +1,43 @@
+import { CustomParametersUtils } from '../../custom_parameters';
+import { DecideActionPhase } from './DecideActionPhase';
+export class EnrichContextFromRequestPhase extends DecideActionPhase {
+    products;
+    dataEnrichment;
+    graphQLParser;
+    constructor(config, products, dataEnrichment, graphQLParser) {
+        super(config);
+        this.products = products;
+        this.dataEnrichment = dataEnrichment;
+        this.graphQLParser = graphQLParser;
+    }
+    async execute(context) {
+        this.config.logger.debug('enrich context from request phase');
+        await this.addPxdeToContext(context);
+        await this.addGraphQLDataToContext(context);
+        await this.addProductDataToContext(context);
+        await this.addCustomParametersToContext(context);
+        await this.updateContextDecision(context);
+        return { done: false };
+    }
+    async addPxdeToContext(context) {
+        const pxdeData = await this.dataEnrichment.handlePxde(context);
+        if (pxdeData) {
+            context.pxde = pxdeData.pxde;
+            context.pxdeVerified = pxdeData.pxdeVerified;
+        }
+    }
+    async addGraphQLDataToContext(context) {
+        if (this.graphQLParser?.isGraphQLRequest(context)) {
+            context.graphqlData = await this.graphQLParser.parseGraphQLRequest(context);
+        }
+    }
+    async addProductDataToContext(context) {
+        await Promise.all(Object.entries(this.products).map(async ([name, product]) => {
+            // @ts-ignore
+            context.productData[name] = await product?.enrichContextFromRequest(context);
+        }));
+    }
+    async addCustomParametersToContext(context) {
+        context.customParameters = await CustomParametersUtils.createCustomParameters(this.config, context);
+    }
+}

package/lib/esm/phase/impl/EnrichContextFromResponsePhase.js

@@ -0,0 +1,20 @@
+export class EnrichContextFromResponsePhase {
+    config;
+    products;
+    constructor(config, products) {
+        this.config = config;
+        this.products = products;
+    }
+    async execute(context) {
+        this.config.logger.debug('enrich context from response phase');
+        await this.addProductDataToContext(context);
+        return { done: false };
+    }
+    async addProductDataToContext(context) {
+        await Promise.all(Object.entries(this.products)
+            .filter(([name, _]) => !!context.productData[name])
+            .map(async ([name, product]) => {
+            Object.assign(context.productData[name], await product?.enrichContextFromResponse(context));
+        }));
+    }
+}

package/lib/esm/phase/impl/FilterPhase.js

@@ -0,0 +1,9 @@
+export class FilterPhase {
+    filters;
+    constructor(filters) {
+        this.filters = filters;
+    }
+    async execute(context) {
+        return { done: this.filters.some((filter) => filter.shouldFilter(context)) };
+    }
+}

package/lib/esm/phase/impl/FirstPartyPhase.js

@@ -0,0 +1,31 @@
+import { MinimalResponseUtils } from '../../http';
+export class FirstPartyPhase {
+    httpClient;
+    firstParties;
+    constructor(httpClient, firstParties) {
+        this.httpClient = httpClient;
+        this.firstParties = firstParties;
+    }
+    async execute(context) {
+        for (const firstParty of this.firstParties) {
+            const firstPartyData = await firstParty.handleFirstPartyRequest(context);
+            if (firstPartyData) {
+                const response = await this.sendFirstPartyRequest(firstPartyData);
+                return { done: true, response };
+            }
+        }
+        return { done: false };
+    }
+    async sendFirstPartyRequest({ request, defaultResponse }) {
+        if (!request) {
+            return defaultResponse;
+        }
+        try {
+            const response = await this.httpClient.send(request);
+            return MinimalResponseUtils.from(response);
+        }
+        catch (e) {
+            return defaultResponse;
+        }
+    }
+}

package/lib/esm/phase/impl/ModifyIncomingRequestPhase.js

@@ -0,0 +1,10 @@
+export class ModifyIncomingRequestPhase {
+    products;
+    constructor(products) {
+        this.products = products;
+    }
+    async execute(context) {
+        await Promise.all(this.products.map((product) => product?.modifyIncomingRequest(context)));
+        return { done: false };
+    }
+}

package/lib/esm/phase/impl/ModifyOutgoingResponsePhase.js

@@ -0,0 +1,14 @@
+import { PXHDSource, PXHDUtils } from '../../pxhd';
+export class ModifyOutgoingResponsePhase {
+    products;
+    constructor(products) {
+        this.products = products;
+    }
+    async execute(context) {
+        await Promise.all(this.products.map((product) => product?.modifyOutgoingResponse(context)));
+        if (context.pxhd?.source === PXHDSource.RISK) {
+            PXHDUtils.addPxhdToOutgoingResponse(context, context.response);
+        }
+        return { done: false };
+    }
+}

package/lib/esm/phase/impl/ParseTokenPhase.js

@@ -0,0 +1,27 @@
+import { TokenParseResult } from '../../risk_token';
+import { transferExistingProperties, VidSource } from '../../utils';
+export class ParseTokenPhase {
+    tokenParser;
+    constructor(tokenParser) {
+        this.tokenParser = tokenParser;
+    }
+    async execute(context) {
+        const tokenData = await this.tokenParser.parseToken(context);
+        this.addTokenDataToContext(context, tokenData);
+        return { done: false };
+    }
+    addTokenDataToContext(context, tokenData) {
+        Object.assign(context.tokenData, tokenData);
+        if (tokenData.tokenParseResult === TokenParseResult.SUCCESSFUL) {
+            transferExistingProperties(tokenData.token, context, {
+                vid: 'vid',
+                uuid: 'uuid',
+                score: 'score',
+                action: 'blockAction',
+            });
+            if (tokenData.token.vid) {
+                context.vidSource = VidSource.RISK_COOKIE;
+            }
+        }
+    }
+}

package/lib/esm/phase/impl/PreflightPhase.js

@@ -0,0 +1,20 @@
+export class PreflightPhase {
+    corsSupportEnabled;
+    filterPreflightRequestsEnabled;
+    cors;
+    constructor(config, cors) {
+        this.corsSupportEnabled = config.corsSupportEnabled;
+        this.filterPreflightRequestsEnabled = config.corsPreflightRequestFilterEnabled;
+        this.cors = cors;
+    }
+    async execute(context) {
+        if (!this.corsSupportEnabled || !this.cors.isPreflightRequest(context)) {
+            return { done: false };
+        }
+        const response = await this.cors.runPreflightCustomHandler(context);
+        if (response) {
+            return { done: true, response };
+        }
+        return { done: this.filterPreflightRequestsEnabled };
+    }
+}

package/lib/esm/phase/impl/RiskApiPhase.js

@@ -0,0 +1,64 @@
+import { Action } from '../../action';
+import { transferExistingProperties } from '../../utils';
+import { DecideActionPhase } from './DecideActionPhase';
+import { ProductName } from '../../products';
+import { PXHDSource } from '../../pxhd';
+export class RiskApiPhase extends DecideActionPhase {
+    products;
+    riskApiClient;
+    constructor(config, products, riskApiClient) {
+        super(config);
+        this.products = products;
+        this.riskApiClient = riskApiClient;
+    }
+    async execute(context) {
+        if (this.shouldTriggerRiskApi(context)) {
+            await this.triggerRiskApi(context);
+            await this.enrichContextFromRiskApi(context);
+            await this.updateContextDecision(context);
+        }
+        return { done: false };
+    }
+    shouldTriggerRiskApi(context) {
+        return context.action === Action.TRIGGER_RISK_API;
+    }
+    async triggerRiskApi(context) {
+        context.riskApiData.s2sCallReason =
+            context.reasons?.[ProductName.BOT_DEFENDER] || context.reasons?.[ProductName.CREDENTIAL_INTELLIGENCE];
+        const riskApiData = await this.riskApiClient.executeRiskApi(context);
+        Object.assign(context.riskApiData, riskApiData);
+    }
+    async enrichContextFromRiskApi(context) {
+        this.addRiskApiDataToContext(context);
+        await this.enrichContextWithProductDataFromRiskApi(context);
+    }
+    addRiskApiDataToContext(context) {
+        const { riskResponse } = context.riskApiData;
+        if (!riskResponse) {
+            return;
+        }
+        transferExistingProperties(riskResponse, context, {
+            score: 'score',
+            uuid: 'uuid',
+            action: 'blockAction',
+            dataEnrichment: 'pxde',
+        });
+        if (riskResponse.dataEnrichment) {
+            context.pxdeVerified = true;
+        }
+        if (riskResponse.pxhd) {
+            context.pxhd = {
+                value: riskResponse.pxhd,
+                domain: riskResponse.pxhdDomain,
+                source: PXHDSource.RISK,
+            };
+        }
+    }
+    async enrichContextWithProductDataFromRiskApi(context) {
+        await Promise.all(Object.entries(this.products).map(async ([name, product]) => {
+            if (context.productData[name]) {
+                Object.assign(context.productData[name], await product?.enrichContextFromRiskApi(context));
+            }
+        }));
+    }
+}

package/lib/esm/phase/impl/SendAsyncActivitiesOnRequestPhase.js

@@ -0,0 +1,16 @@
+import { Action } from '../../action';
+export class SendAsyncActivitiesOnRequestPhase {
+    activityClient;
+    constructor(activityClient) {
+        this.activityClient = activityClient;
+    }
+    async execute(context) {
+        if (context.action === Action.BLOCK) {
+            await this.sendAsyncActivity(context);
+        }
+        return { done: false };
+    }
+    async sendAsyncActivity(context) {
+        await this.activityClient.sendActivities(context);
+    }
+}

package/lib/esm/phase/impl/SendAsyncActivitiesOnResponsePhase.js

@@ -0,0 +1,10 @@
+export class SendAsyncActivitiesOnResponsePhase {
+    activityClient;
+    constructor(activityClient) {
+        this.activityClient = activityClient;
+    }
+    async execute(context) {
+        await this.activityClient.sendActivities(context);
+        return { done: false };
+    }
+}

package/lib/esm/phase/impl/SendLogsPhase.js

@@ -0,0 +1,16 @@
+import { X_PX_ENFORCER_LOG_HEADER } from '../../logger';
+export class SendLogsPhase {
+    config;
+    logServiceClient;
+    constructor(config, logServiceClient) {
+        this.config = config;
+        this.logServiceClient = logServiceClient;
+    }
+    async execute(context) {
+        const headerValue = context.requestData.headers[X_PX_ENFORCER_LOG_HEADER]?.[0];
+        if (headerValue == this.config.loggerAuthToken) {
+            await this.logServiceClient.sendLogs(context, this.config.logger.getLogs());
+        }
+        return { done: false };
+    }
+}

package/lib/esm/phase/impl/TelemetryPhase.js

@@ -0,0 +1,17 @@
+export class TelemetryPhase {
+    telemetry;
+    constructor(telemetry) {
+        this.telemetry = telemetry;
+    }
+    async execute(context) {
+        if (await this.telemetry.isValidTelemetryRequest(context)) {
+            await this.sendTelemetry(context);
+            return { done: true };
+        }
+        return { done: false };
+    }
+    // Note: If await is not necessary, can be overridden
+    async sendTelemetry(context) {
+        await this.telemetry.sendTelemetry(context);
+    }
+}

package/lib/esm/products/account_defender/AccountDefender.js

@@ -0,0 +1,79 @@
+import { getPropertyFromObject } from '../../utils';
+import { CROSS_TAB_SESSION_COOKIE_NAME } from './constants';
+export class AccountDefender {
+    config;
+    base64Utils;
+    constructor(config, options) {
+        this.config = config;
+        this.base64Utils = options.base64Utils;
+    }
+    async enrichContextFromRequest(context) {
+        const crossTabSession = context.requestData.cookies[CROSS_TAB_SESSION_COOKIE_NAME];
+        const jwtData = this.getJwtData(context.requestData);
+        return { crossTabSession, ...jwtData };
+    }
+    async enrichContextFromRiskApi(context) {
+        return;
+    }
+    async enrichContextFromResponse(context) {
+        return;
+    }
+    async modifyIncomingRequest(context) {
+        return;
+    }
+    async modifyOutgoingResponse(context) {
+        return;
+    }
+    getJwtData(requestData) {
+        let jwtToken;
+        let userIdFieldName;
+        let additionalFieldNames;
+        if (this.config.jwtCookieName) {
+            jwtToken = requestData.cookies[this.config.jwtCookieName];
+            if (jwtToken) {
+                userIdFieldName = this.config.jwtCookieUserIdFieldName;
+                additionalFieldNames = this.config.jwtCookieAdditionalFieldNames;
+            }
+        }
+        if (!jwtToken && this.config.jwtHeaderName) {
+            jwtToken = requestData.headers[this.config.jwtHeaderName]?.[0];
+            if (jwtToken) {
+                userIdFieldName = this.config.jwtHeaderUserIdFieldName;
+                additionalFieldNames = this.config.jwtHeaderAdditionalFieldNames;
+            }
+        }
+        return jwtToken ? this.extractJwtData(jwtToken, userIdFieldName, additionalFieldNames) : null;
+    }
+    extractJwtData(jwt, userIdFieldName, additionalFieldNames) {
+        try {
+            const decodedJwt = this.getDecodedJwt(jwt);
+            if (decodedJwt) {
+                const appUserId = getPropertyFromObject(decodedJwt, ...userIdFieldName.split('.'));
+                const additionalFields = additionalFieldNames.reduce((matchedFields, fieldName) => {
+                    const fieldNameParts = fieldName.split('.');
+                    const value = getPropertyFromObject(decodedJwt, ...fieldNameParts);
+                    if (value) {
+                        matchedFields[fieldNameParts[fieldNameParts.length - 1]] = value;
+                    }
+                    return matchedFields;
+                }, {});
+                return { additionalFields, appUserId };
+            }
+        }
+        catch (e) {
+            this.config.logger.debug(`unable to get account defender JWT data: ${e}`);
+        }
+        return null;
+    }
+    getDecodedJwt(jwt) {
+        try {
+            const encodedPayload = jwt.split('.')?.[1];
+            const base64 = encodedPayload.replace('-', '+').replace('_', '/');
+            return JSON.parse(this.base64Utils.base64Decode(base64));
+        }
+        catch (e) {
+            this.config.logger.debug(`unable to decode account defender jwt token: ${e}`);
+            return null;
+        }
+    }
+}

package/lib/esm/products/bot_defender/BotDefender.js

@@ -0,0 +1,114 @@
+import { Action } from '../../action';
+import { TokenParseResult } from '../../risk_token';
+import { RiskApiCallResult } from '../../risk_api';
+import { EnforcerError, isRouteInPatterns } from '../../utils';
+import { BotDefenderActionData, isMonitoredRequest } from '../';
+import { DefaultBotDefenderFirstParty } from './first_party';
+import { DefaultBotDefenderFilter } from './filter';
+import { BotDefenderBlockReason, BotDefenderPassReason, BotDefenderS2SCallReason } from './reasons';
+import { BotDefenderUtils } from './BotDefenderUtils';
+import { DefaultBotDefenderBlocker } from './block';
+export class BotDefender {
+    config;
+    firstParty;
+    filter;
+    blocker;
+    constructor(config, options) {
+        this.config = config;
+        this.firstParty = options.firstParty ?? new DefaultBotDefenderFirstParty(config);
+        this.filter = options.filter ?? new DefaultBotDefenderFilter(config, options.ipRangeChecker);
+        this.blocker = options.blocker ?? new DefaultBotDefenderBlocker(config, options.base64Utils);
+    }
+    async handleFirstPartyRequest(context) {
+        return this.firstParty.handleFirstPartyRequest(context);
+    }
+    shouldFilter(context) {
+        return this.filter.shouldFilter(context);
+    }
+    async enrichContextFromRequest(context) {
+        const isMonitoredRequest = this.isMonitoredRoute(context);
+        const isSensitiveRequest = this.isSensitiveRequest(context) || context.graphqlData?.some((operation) => operation.sensitive);
+        const actionData = await this.getTokenAction(context, isMonitoredRequest, isSensitiveRequest);
+        return {
+            ...actionData,
+            isMonitoredRequest,
+            isSensitiveRequest,
+        };
+    }
+    isMonitoredRoute(context) {
+        return isMonitoredRequest(this.config, context);
+    }
+    isSensitiveRequest({ requestData: { url } }) {
+        // TODO: Include custom sensitive request function
+        return isRouteInPatterns(url.pathname, this.config.sensitiveRoutes);
+    }
+    async enrichContextFromResponse(context) {
+        return;
+    }
+    async getTokenAction(context, isMonitoredRequest, isSensitiveRequest) {
+        switch (context.tokenData.tokenParseResult) {
+            case TokenParseResult.NONE:
+                return new BotDefenderActionData(Action.TRIGGER_RISK_API, this.getNoTokenS2SCallReason(context));
+            case TokenParseResult.DECRYPTION_FAILED:
+                return new BotDefenderActionData(Action.TRIGGER_RISK_API, BotDefenderS2SCallReason.COOKIE_DECRYPTION_FAILED);
+            case TokenParseResult.VALIDATION_FAILED:
+                return new BotDefenderActionData(Action.TRIGGER_RISK_API, BotDefenderS2SCallReason.COOKIE_VALIDATION_FAILED);
+            case TokenParseResult.SUCCESSFUL:
+                return this.getActionForSuccessfulTokenParse(context, isMonitoredRequest, isSensitiveRequest);
+        }
+    }
+    getNoTokenS2SCallReason({ pxhd, isMobile, tokenData, }) {
+        if (isMobile && tokenData.mobileData?.mobileError) {
+            return BotDefenderUtils.getS2SCallReasonFromMobileError(tokenData.mobileData.mobileError);
+        }
+        if (pxhd) {
+            return BotDefenderS2SCallReason.NO_COOKIE_WITH_VID;
+        }
+        return BotDefenderS2SCallReason.NO_COOKIE;
+    }
+    getActionForSuccessfulTokenParse({ tokenData: { token } }, isMonitoredRequest, isSensitiveRequest) {
+        if (token.isExpired()) {
+            return new BotDefenderActionData(Action.TRIGGER_RISK_API, BotDefenderS2SCallReason.COOKIE_EXPIRED);
+        }
+        if (token.isHighScore()) {
+            return new BotDefenderActionData(isMonitoredRequest ? Action.SIMULATED_BLOCK : Action.BLOCK, BotDefenderBlockReason.COOKIE_HIGH_SCORE);
+        }
+        if (isSensitiveRequest) {
+            return new BotDefenderActionData(Action.TRIGGER_RISK_API, BotDefenderS2SCallReason.SENSITIVE_ROUTE);
+        }
+        return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.COOKIE);
+    }
+    async enrichContextFromRiskApi(context) {
+        return await this.getRiskApiActionData(context);
+    }
+    async getRiskApiActionData({ riskApiData, productData: { bd }, }) {
+        switch (riskApiData.riskApiCallResult) {
+            case RiskApiCallResult.NONE:
+                throw new EnforcerError('risk api call result should not be none!');
+            case RiskApiCallResult.ERROR:
+                return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.S2S_ERROR);
+            case RiskApiCallResult.TIMEOUT:
+                return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.S2S_TIMEOUT);
+            case RiskApiCallResult.SUCCESSFUL:
+                return this.getSuccessfulRiskApiAction(riskApiData.riskResponse, bd.isMonitoredRequest);
+        }
+    }
+    getSuccessfulRiskApiAction(riskResponse, isMonitored) {
+        if (riskResponse.score >= this.config.blockingScore) {
+            return new BotDefenderActionData(isMonitored ? Action.SIMULATED_BLOCK : Action.BLOCK, BotDefenderBlockReason.S2S_HIGH_SCORE);
+        }
+        return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.S2S);
+    }
+    shouldBlock(context) {
+        return this.blocker.shouldBlock(context);
+    }
+    createBlockResponse(context) {
+        return this.blocker.createBlockResponse(context);
+    }
+    async modifyIncomingRequest(context) {
+        // intentionally left blank
+    }
+    async modifyOutgoingResponse(context) {
+        // intentionally left blank
+    }
+}

package/lib/esm/products/bot_defender/BotDefenderActionData.js

@@ -0,0 +1,8 @@
+export class BotDefenderActionData {
+    action;
+    reason;
+    constructor(action, reason) {
+        this.action = action;
+        this.reason = reason;
+    }
+}

package/lib/esm/products/bot_defender/block/DefaultBotDefenderBlocker.js

@@ -0,0 +1,41 @@
+import { Action } from '../../../action';
+import { BlockAction } from '../../../blocker';
+import { ContentType, CONTENT_TYPE_HEADER_NAME, MinimalResponseImpl } from '../../../http';
+import { ProductName } from '../../utils';
+import { CaptchaBlocker } from './captcha';
+import { RATE_LIMIT_TEMPLATE } from './templates';
+export class DefaultBotDefenderBlocker {
+    config;
+    captchaBlocker;
+    constructor(config, base64Utils) {
+        this.config = config;
+        this.captchaBlocker = new CaptchaBlocker(config, base64Utils);
+    }
+    shouldBlock({ action, reasons, productData }) {
+        return action === Action.BLOCK && !!reasons?.[ProductName.BOT_DEFENDER];
+    }
+    createBlockResponse(context) {
+        switch (context.blockAction) {
+            case BlockAction.RATE_LIMIT:
+                return this.createRateLimitResponse();
+            case BlockAction.CHALLENGE:
+            case BlockAction.CAPTCHA:
+            default:
+                return this.createCaptchaResponse(context);
+        }
+    }
+    createRateLimitResponse() {
+        const status = 429;
+        const headers = {
+            [CONTENT_TYPE_HEADER_NAME]: [ContentType.TEXT_HTML],
+        };
+        return new MinimalResponseImpl({
+            body: RATE_LIMIT_TEMPLATE,
+            status: status,
+            headers: headers,
+        });
+    }
+    createCaptchaResponse(context) {
+        return this.captchaBlocker.createBlockResponse(context);
+    }
+}

package/lib/esm/products/bot_defender/block/captcha/CaptchaBlocker.js

@@ -0,0 +1,24 @@
+import { JsonCaptchaBlocker } from './JsonCaptchaBlocker';
+import { MobileCaptchaBlocker } from './MobileCaptchaBlocker';
+import { HtmlCaptchaBlocker } from './HtmlCaptchaBlocker';
+export class CaptchaBlocker {
+    config;
+    jsonCaptchaBlocker;
+    mobileCaptchaBlocker;
+    htmlCaptchaBlocker;
+    constructor(config, base64Utils) {
+        this.config = config;
+        this.jsonCaptchaBlocker = new JsonCaptchaBlocker(config);
+        this.mobileCaptchaBlocker = new MobileCaptchaBlocker(config, base64Utils);
+        this.htmlCaptchaBlocker = new HtmlCaptchaBlocker(config);
+    }
+    createBlockResponse(context) {
+        if (this.mobileCaptchaBlocker.shouldBlock(context)) {
+            return this.mobileCaptchaBlocker.createBlockResponse(context);
+        }
+        if (this.jsonCaptchaBlocker.shouldBlock(context)) {
+            return this.jsonCaptchaBlocker.createBlockResponse(context);
+        }
+        return this.htmlCaptchaBlocker.createBlockResponse(context);
+    }
+}

package/lib/esm/products/bot_defender/block/captcha/HtmlCaptchaBlocker.js

@@ -0,0 +1,21 @@
+import { ContentType, CONTENT_TYPE_HEADER_NAME, MinimalResponseImpl } from '../../../../http';
+import { createBlockData, renderHtml } from '../utils';
+import { CAPTCHA_TEMPLATE } from '../templates';
+export class HtmlCaptchaBlocker {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    createBlockResponse(context) {
+        const status = 403;
+        const headers = {
+            [CONTENT_TYPE_HEADER_NAME]: [ContentType.TEXT_HTML],
+        };
+        const body = renderHtml(CAPTCHA_TEMPLATE, createBlockData(this.config, context));
+        return new MinimalResponseImpl({
+            body: body,
+            status: status,
+            headers: headers,
+        });
+    }
+}

package/lib/esm/products/bot_defender/block/captcha/JsonCaptchaBlocker.js

@@ -0,0 +1,39 @@
+import { BlockAction } from '../../../../blocker';
+import { ContentType, CONTENT_TYPE_HEADER_NAME, ACCEPT_HEADER_NAME, MinimalResponseImpl, } from '../../../../http';
+import { createBlockData } from '../utils';
+export class JsonCaptchaBlocker {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    shouldBlock(context) {
+        if (!this.config.advancedBlockingResponseEnabled) {
+            return false;
+        }
+        const acceptHeaderValue = context.requestData.request.headers.get(ACCEPT_HEADER_NAME) || '';
+        const acceptHeaderContainsJson = acceptHeaderValue
+            ?.split(',')
+            .some((value) => value.toLowerCase() === ContentType.APPLICATION_JSON);
+        return !context.isMobile && context.blockAction !== BlockAction.RATE_LIMIT && acceptHeaderContainsJson;
+    }
+    createBlockResponse(context) {
+        const status = 403;
+        const headers = {
+            [CONTENT_TYPE_HEADER_NAME]: [ContentType.APPLICATION_JSON],
+        };
+        const blockData = createBlockData(this.config, context);
+        const jsonBlockPayload = {
+            appId: blockData.appId,
+            jsClientSrc: blockData.jsClientSrc,
+            customLogo: blockData.customLogo,
+            firstPartyEnabled: blockData.firstPartyEnabled,
+            vid: blockData.vid,
+            uuid: blockData.uuid,
+            hostUrl: blockData.hostUrl,
+            blockScript: blockData.blockScript,
+            altBlockScript: blockData.altBlockScript,
+        };
+        const body = JSON.stringify(jsonBlockPayload);
+        return new MinimalResponseImpl({ status, headers, body });
+    }
+}