Skip to content

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

1.1.1

Added

  • Added IMEI checksum validation (Luhn / mod-10). Call DeviceAssure.validateIMEIFormat(imei) directly to run the check on demand. See IMEI Format Validation.
  • New validateIMEIFormat option on .load validates the IMEI supplied through the imei configuration, blocking the request when it fails. A passing check is recorded as data.telephony.validateIMEIFormat on the payload. See IMEI Format Validation.
  • .qr accepts the same validateIMEIFormat flag and will not generate a QR code for an IMEI that fails the check. A failure is reported through the qr callback, not onError — and thrown if no callback was supplied, matching how load already behaves. The existing checks that an IMEI is a string and not blank now also run on every qr call, with or without validateIMEIFormat. See DeviceAssure.qr().
  • Improved spoofing detection with an additional device-consistency signal.
  • New requestTimeout option (default 10s per attempt, 1s–60s) applying an XMLHttpRequest timeout to each API request. A timed-out request fails over to the next url, and onError is called with timeout: true once every url has been tried. Previously no timeout was set at all, so a hung endpoint never called back. Feature detected and guarded, as the ActiveXObject transports used by older versions of IE can throw when the property is set. Also supported for legacy DeviceAssure = { options: {...} } configurations. See Request Timeout.

Fixed

  • Any 2xx response is now treated as a success rather than only 200 and 202. Note that a success is cached and passed to onSuccess, so a bodyless 2xx such as 204 from a self-hosted proxy will be served to later checks until the cache expires.
  • Options are now re-read on every load(), and accumulate rather than replace. They were previously frozen at the first call, so an on-event integration calling load() again from a click handler had its new options silently ignored. Values supplied by a later call win; anything it leaves out keeps the value already set — previously, a partial second load() silently reset every option it left out. For example, a self-hosted integration passing urls on page load and then calling load({ storageType: 'none', onSuccess: cb }) from a click handler would have had urls reset to the DeviceAssure cloud endpoints and its licence dropped. The variant id is deliberately kept stable across these calls, so mid-session variant tracking is unaffected.
  • A request that never completes no longer wedges the library. With no timeout set, nothing was ever fired: no failover, no onError, and the internal loading flag stayed set, which made every later check return early for the rest of the page. See the new requestTimeout option.
  • A response with no usable status no longer stalls silently. A DONE ready state with a status of 0 — a network failure, a CORS rejection, an aborted request or a timeout, all common on mobile — matched neither the success, ignored nor error branch, so execution fell through and no callback ran and loading was never cleared. The 1xx and 3xx ranges had the same problem. Anything that is not a success and is not an ignored status is now treated as a retryable error.
  • A single failed request can no longer be settled twice. A status of 0 notifies through both onreadystatechange and onerror, which double-incremented the failover index and silently skipped a url, and could call onError twice.
  • configs.method is no longer lost on failover retries. Previously it was dropped on the second and later attempts, so a check was incorrectly reported under a different trigger than the one that started it.
  • Every kind of failure now works through the whole configured url list before onError is called, so a healthy url later in the list is always reached. This covers the cases that previously had no callback at all: a status of 0 (a network failure, a CORS rejection or an aborted request), a timeout, and the 1xx/3xx ranges.
  • The options that the deprecated check, checkIMEI and getData entry points inject for their own use no longer outlive the next load(). getData's fallback sets serverToServer and checkIMEI's sets imei; once options accumulated across calls, one such call would have kept that setting for the life of the page — leaving the library in server-to-server mode, sending nothing to the API, or attaching a stale IMEI to every later check. The injected value still applies for the call that needed it and until the next load() replaces it, which is unchanged behaviour. As a side effect, configs.entryPoint in the payload now correctly reports which entry point started each check, rather than always reporting the same one.
  • A load() whose options are rejected — a licence together with custom urls — no longer poisons the configuration. The options were kept before they were validated, so after one such call every later load() merged the rejected pair back in and threw again, leaving the library unusable for the rest of the page.
  • The session is now completed when a request cannot be created, matching every other terminal outcome. The request id was previously left in place, so the next check reported the failed one's.
  • Calling load() with an option explicitly set to undefined no longer clears a value already supplied. A caller cannot distinguish that from leaving the option out, so an unresolved variable used to wipe a working configuration. A key that is present but undefined is still honoured where it carries meaning, notably imei, which reports an error rather than being ignored.
  • Switching between a licence and custom urls on a later load() no longer throws. Accumulated options left both set, which the configuration check rejects; the previous value is now dropped in favour of the one just supplied. Passing both in a single call still throws, as before.
  • The request id no longer changes partway through a check. It is cached on the options object, which is now rebuilt on every load(), so a load() while a request was in flight made the next failover attempt report an id matching neither the earlier attempts nor the one already built into the payload.
  • A failed attempt that cannot create its request no longer wedges the library. onError was called but the internal loading flag was left set, so every later check returned early for the rest of the page. The same applies to a failover retry that turns out to be answerable from the cache.
  • An imei passed to load() now applies to that check only, instead of being kept and attached to every later one. Since IMEI mode is decided by the option being present rather than by its value, a kept imei could not be cleared, leaving the library either re-checking a stale IMEI or reporting an error for every subsequent check.
  • A failover chain now stays on the urls it started with. The configuration is rebuilt on each load(), so a load() that switched url sets partway through a check could retarget the remaining attempts — sending a self-hosted payload to the cloud endpoints — and a shorter set left the attempt index past the end of the list, throwing out of the response handler and wedging the library.
  • A server-to-server call no longer disturbs a client-to-server check that is still in flight. getData and the other payload-only entry points build a payload without sending anything, so they are not covered by the guard that protects the other entry points; they used to move the in-flight check's collection marker and close out its session, stripping the request id from its retries.
  • The legacy DeviceAssure = { options: {...} } setup no longer overrides options passed to a later load(). It supplied the library's internal option shape, in which the internal storage-type name outranks the public storageType, so a subsequent load({ storageType: 'none' }) was still read as local-storage and its cache consulted.
  • Fixed window_chrome collection to report the real window.chrome presence; it was previously mis-wired to Safari-presence data (duplicating the safari property).

1.1.0

Added

  • Added Vue, React and Angular examples to the source package. See examples/frameworks for more details.
  • Added the ability to render a QR code via the qr method. See the QR Code guide for usage.
  • Added the ability to parse a QR redirect via the parseQrRedirect method. See the QR Code guide for usage.
  • Added the imei flow and tags support to the qr method.
  • Added window property detection.

Changed

  • Renamed the library global from DeviceValidation to DeviceAssure. The old DeviceValidation reference still works but is deprecated and will be removed in a later release.
  • Renamed the built file from deviceAssure-XXX.min.js to deviceassure-XXX.min.js.

1.0.34

Changed

  • The source-package sample application is now a Fastify-based application; see the README for updated run instructions.
  • Updated to DeviceAtlas client-side library 2.7.3.

Removed

  • Removed the check, checkIMEI and getData methods from the documentation; use the load method instead.

1.0.33

Added

  • Updated example pages to show a note about using a secure context for accurate results.

Changed

  • Updated to latest 2.7.2 version of the DeviceAtlas clientside library. Improved Apple Detection.

1.0.32

Added

  • Ability to collect IMEI via Server to Server.

Fixed

  • Collecting additional properties to help with private mode detection

1.0.31

Added

  • Updating to the latest clientside library 2.6

Fixed

  • Incorrect examples for custom tags setup in README

1.0.30

Changed

  • Updating DeviceAtlas clientside library to latest 2.5.2
  • Updating Implementation Guide to latest version

1.0.29

Changed

  • Implementation Guide updates

1.0.28

Added

  • Added ability to add 'tags' to the request via the options object.

Changed

  • Updated storageType 'None' to no longer clear existing cache if already set from previously used storageType options 'cookie' or 'local-storage'.

1.0.27

Added

  • Added private browsing detection
  • Adding the capture of a new property screen.availTop.
  • Added collection of the navigator.maxTouchPoints
  • Added more properties to detect invalid browser/device claims from client hints.
  • Added more automation properties to the collection.
  • Promises to collect new and existing properties. When not present a non-Promise method is used.
  • Updated library to be built off webpack

Changed

  • Updated the retry mechanism to not make multiple requests if the response status code one of 403, 409, 410, 422 or 429.

Fixed

  • Allowing .check, .getData and .checkIMEI to run without a definition of DeviceValidation in the window.

1.0.26

Added

  • Added a check on the DV cache to not run the rest of the library if we already have a cache.
  • Added hook and examples for on callback for server to server.
  • Trimming white space for string configs [licence, urls and storageType].
  • Added the identification of a request being made in a secure context.
  • Added load method, which when called will load the DeviceAssure library and run based on the configs passed in. Library is backwards compatible with the legacy methods.
  • Added Migration Guide for new load method.
  • Added Implementation Guide for DeviceAssure to source package.

Changed

  • Updated example pages to look more consistent.
  • Changed the format of the IMEI error response to be wrapped in an object instead of a string. onError is also called now too.
  • When using the new load method, the library will only run when called.
  • Updated the README for these new changes and examples.

Deprecated

  • getData was deprecated. It will be removed in later releases.
  • check was deprecated. It will be removed in later releases.
  • checkIMEI was deprecated. It will be removed in later releases.
  • Setting up the library with the DeviceValidation object was deprecated. It will be removed in later releases.

Removed

  • Removed vendor folder from examples, using CDN for jQuery and Bootstrap in example pages.

Fixed

  • Improved IMEI error handling.

1.0.25

Fixed

  • Added minor fixes to run on IE 11 and 10.

1.0.24

Added

  • Adding ability to link variant device assure libraries running on the same page.

1.0.23

Added

  • Added the collection of screen properties.

1.0.22

Added

  • Added the collection of automation tool identification.
  • Added the collection of headless browser identification.
  • Minor README updates

1.0.21

Added

  • Added the collection of language and languages

1.0.20

Added

  • Adding the collection of browser identification properties for Brave, Opera and Safari.
  • Including the DeviceAtlas Device Verification QR Code Example
  • Updated how Sample Application in source package and added README entry for how to run it.

Fixed

  • Fixing issue where DeviceAtlasCollector was not always configured correctly.

1.0.19

Fixed

  • Renaming DeviceAtlas object to DeviceAtlasCollector to avoid conflicts with other libraries.

1.0.18

Added

  • Added config to override URLs

Changed

  • Updated to the latest 2.4.6 clientside library.

Deprecated

  • getData was deprecated. It will be removed in later releases.

1.0.17

Changed

  • Updated to the latest 2.4.4 clientside library.

1.0.16

Changed

  • Updated formatting in the README

1.0.15

Added

  • Added window.DeviceValidation hook and updated README to show how to use it.
  • Added a new example page for the On Event example.
  • Added new config for setting the storage expiry called storageExpiry.
  • Added new option for storageType called none.
  • Store the result of the DeviceAssure call in to the cache now.

Changed

  • Updated README to have more practical examples.
  • Updated README to list all the configs and methods this web library has.
  • Adding application/json to the http request header.
  • Updated to the latest 2.4.3 clientside library.

Fixed

  • Preventing double /check request being sent on page load.

1.0.14

Changed

  • Updated README content for IMEI DeviceCheck

1.0.13

Changed

  • Updated to use clientside library of 2.4.1 (latest as of 6th April 2023)

1.0.12

Added

  • Adding some iOS specific js property collection
  • Adding clientSide string to the payload under 'data.web.webview.clientSide'

Changed

  • Updated how jsProps field is generated. It is now using the embedded DeviceAtlas library to generate this.

1.0.11

Added

  • GSMA Device-Check demo page.
  • Added Example URLS to each demo page.

1.0.10

Fixed

  • Fix possible null pointer exception for serverToServerEnabled option.

1.0.9

Added

  • library-type header.
  • Added the ability to change the location of the TTL to 'cookie' or 'local-storage'.
  • Added hasVibration field to jsProps.

Changed

  • Updated to the latest DeviceAtlas client-side library.
  • Updated Documentation for storageType config.
  • Underlying DAPROPS cookie has been turned off.

Deprecated

Removed

Fixed

  • Fixed an issue where DeviceAtlas library was still running even if no request sent. Data collection only occurs now when the TTL storage has expired.
  • Fixed an issue on running the DeviceAssure Check on older iOS devices.
  • Fixed an issue where errors on the callback function were not showing in the example pages.

Security

1.0.8

Added

  • Added 'audioRef' property retry when not present on Apple devices on first load of dv library.

Changed

  • Updated the Bootstrap library to 5.1.2 for the example pages.
  • Updated the example UI to include a loading spinner and code like snippet for our example snippets for the serverToServer and normal example pages.

Deprecated

  • No need to call DeviceValidation.check() for import of dv.min.js, library will auto send results when loaded and serverToServer is switched off. This call is now mainly used for manually triggering the Check API call.

Removed

  • Removed the DeviceValidation.check() call on load of our example page, it was causing a race condition.

Fixed

  • The retrieval of the 'audioRef' property is now more reliable on first load of our library for Apple devices.
  • Fixed the setting of the 'onSuccess' and 'onError' blocks in the DeviceValidation config object.

1.0.7

Changed

  • Updated the customer documentation to highlight the 30 minute period that no calls are made from the browser while the cookie is in place.

1.0.6

Changed

  • Updated the Package Json to match that of the current release numbers.
  • Added a new property to indicate when the request is from a Server to Server request.

1.0.5

  • Updated library for ServerToServer implementation. Library will not make a DeviceAssure check call automatically upon loading if serverToServer is set to true in DeviceValidation's option. Added a new function 'getData' which can accept a callback function to get value asynchronously or can return data synchronously via blocking call.
  • Added an example page to demonstrate how the ServerToServer implementation works.

1.0.4

  • Updated library not to continue sending requests when a 429 is returned.

1.0.3

Added

  • Updated library to work with 1.9.1 of the client-side library

1.0.2

Added

  • New property for collection 'ApplePaySession'

1.0.1

Added

  • Add following new properties into the data collector: navigator.connection.saveData navigator.deviceMemory navigator.oscpu navigator.platform navigator.productSub navigator.webdriver window.screen.width window.screen.availWidth window.screen.height window.screen.availHeight navigator.mediaDevicessharing

Changed

  • Updated the deviceatlas js file from 1.7 to be the latest version 1.8 which adds iOS 12.2 devices detection.

1.0.0

Changed

  • Updated the documentation to mention the usage of the cookie.
  • Removing Beta postfix as the library is no longer in beta.