Skip to content

v1.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Nov 01:15
· 6 commits to main since this release
v1.2.0
529f03a

PageSift 1.2.0 Release Notes

Release Version: v1.2.0
License: AGPL-3.0-only (Commercial licensing available)

Changes since 1.1.3. Speed and quality figures in the README were measured on 1.1.0 and were not measured again for this release.

Access-barrier recovery (opt-in)

[itna] enabled = true adds a bounded recovery path for normal HTTP requests. It is off by default; with it off, the existing request path and configuration behave as before.

  • HTTP results are classified by status, response headers and the existing barrier rules.
  • A blocked or challenge HTTP result may get one browser retry on the same egress. Rate limits (429 and Retry-After), login walls and an explicit engine = "http" do not escalate.
  • Redirects and browser sub-requests draw from one network budget. When the budget is exhausted the request fails closed instead of continuing unbudgeted.
  • The attempt trace is reported in metadata.pagesift.itna or in the error details.

Sessions and identities

  • Sessions are leased per owner, origin, egress and fingerprint. API requests with a stable caller identity can reuse a session across requests; anonymous requests receive a per-request session. Different owners never share a session.
  • 429 and 5xx responses, and cancellation, no longer count as identity failures. 401 and 403 still count.
  • Retired sessions are removed from the pool. A lease is released on cancellation as well as on success or failure.

Fingerprint transport through proxies

  • browser_fingerprint can now be combined with an HTTP proxy (HTTP CONNECT), an HTTPS proxy, SOCKS5 or SOCKS5H.
  • Targets are resolved and SSRF-checked locally; the proxy receives an IP address, while TLS SNI and the HTTP authority keep the original hostname.
  • TLS and HTTP/2 still use the existing fingerprint-shaped transport. Proxy TLS certificates are verified.
  • A failed proxy or target tunnel is reported as an error. It is not silently downgraded to a plain reqwest request or a direct connection.
  • socks5h resolves targets locally, like socks5, because the target must pass the SSRF check before the tunnel opens.

HTTP to browser handoff

  • Cookies from the HTTP session are imported into an isolated browser context only for the exact origin.
  • Imported cookies are host-only. Browsers do not isolate cookies by port, so same-host requests on another scheme or port are blocked, except the standard http:80 to https:443 upgrade. HTTPS to HTTP is blocked.
  • Path, Secure, HttpOnly and expiry are preserved. Imported cookies use SameSite=Strict because the session store does not keep SameSite.
  • The handoff is refused when the HTTP fingerprint's Chrome major version differs from the running browser's major version.

Browser automation markers and challenges

  • When itna is enabled, the default launch arguments omit the Blink automation marker, and a document-start script clears navigator.webdriver for local and remote browsers. It does not fabricate hardware or identity.
  • Non-interactive JavaScript challenges get a bounded settle wait: at most 8 seconds and never beyond the request timeout.
  • Pages with interactive CAPTCHA widgets are not waited for. They return ACCESS_BARRIER with needsHuman: true. No CAPTCHA solver is included.

Verification

  • Covered by local controlled fixtures in the release test suites for pagesift-itna, pagesift-net, pagesift-cdp, pagesift-policy, pagesift-engine and pagesift-api.
  • Local fixtures cover classification, attempt and network budgets, cancellation, proxy failure, certificate rejection, session isolation, cookie scope, automation-marker removal, non-interactive challenge settling and interactive-CAPTCHA reporting.
  • cargo fmt --check, git diff --check and cargo deny --config .github/deny.toml check pass.
  • No production-site or WAF pass-rate claims were measured for this release.

Compatibility

  • No configuration or data migration is required. The [itna] section is optional and disabled when omitted.
  • Existing proxy-only and fingerprint-only configurations keep their previous behavior. A combined fingerprint-and-proxy configuration that was rejected before now opens a validated tunnel.
  • Speed and quality figures in the README were measured on 1.1.0 and were not measured again for this release.

Questions or feedback: Discord

Assets 17
Loading