Current release: 6.5.0
The 6.5 release of Cequence Defender adds geo-based mitigation criteria for policies. Geo-based mitigation criteria can apply to both dynamic and global policies. Global policies can apply geo-based mitigation criteria from the first request. Geo-based mitigation supports the unified inventory feature, which consolidates all endpoint information in on eplace. Endpoint details now show threat information and endpoint risks, along with mitigation, traffic, and error statistics. This release also caps decompressed body size, reduces memory use when API specifications reload, and includes reliability and hardening fixes. The 6.5 release of Defender pairs with AAP release 9.4, and AAP release 9.4 requires Defender release 6.5 or later.
Changed behavior
Release 6.5 changes the following default behavior.
Defender now generates the nginx self-signed TLS key and certificate for each container when the container starts, instead of when the image builds.
Defender now caps decompressed request and response bodies at 1 MiB in the sensor connector and in the nginx sensor script, and keeps the decoded portion of a body that reaches the cap or ends early.
The default maximum length of a sensor log line is now 128k.
Defender now includes the Accept-CH response header.
Error responses no longer include a hint field.
Defender no longer supports the MFA_JSON401_ENABLED=false setting, so the JSON 401 response for multi-factor authentication failures always applies.
New features
Release 6.5 adds the following capabilities.
Geo-based mitigation
Mitigation policies can now match the client IP address by country, organization, or autonomous system number (ASN), starting with the first request from any IP address. Previously, a dynamic policy that targeted a country or ISP took effect only after Defender had already seen the client IP address, so the first request from each new IP address passed through. Defender refreshes the geographic databases and switches to the new data without a reload. Geo Location criteria require AAP release 9.4 or later.
After an upgrade, Defender skips geo policies until the geo database downloads from AAP, which takes a minute or two after Defender starts.
Client IP extraction from the Forwarded header
Defender now reads the client IP address from the Forwarded header, in addition to the other supported headers, on the nginx path.
Parameterized host and endpoint key in mitigation records
Mitigation records now carry the parameterized URI, the parameterized host, and the endpoint key. AAP groups mitigated and flagged requests under the same endpoint as the rest of your traffic data, such as /users/{id}, instead of listing a separate entry for each ID or host value.
Parameterized discovery stream
Endpoints that Defender discovers now appear in AAP as parameterized endpoints, according to the same parameterization rules that apply to sensor data. Discovered endpoints that differ only by a variable segment, such as an ID, appear as one endpoint instead of many. This reduces clutter and keeps endpoint counts consistent across AAP views.
Mitigation visibility for rate-limited requests
Mitigated rate-limited requests are labled to indicate requests below and above the threshold. Requests below threshold that received an Allow action appear in the Flagged tiles on AAP dashboards.
Biometric challenge for mobile apps
The biometric challenge now supports issuer-supplied identifiers and an explicit client-type header, which extends the challenge to mobile apps.
Enhanced challenge support
The Defender challenge feature now supports single-page application (SPA) clients and mobile clients on both iOS and Android devices. Mobile support includes two integration models. The challenge page also renders in the browser's native language for 14 supported languages.
Additional observability enhancements
Defender now reports memory metrics for the mitigator module. Defender also logs stealth-check, /__cq, and /metrics requests to a separate access_internal.log file.
Known issues
The following issues are known in release 6.5.
The biometric challenge page for single-page applications and mobile apps returns an nginx 404 response unless the name of the challenge template contains "challenge" or "biometric." Include one of these words in the challenge template name.
Defender does not convert IPv4-mapped IPv6 client addresses, such as ::ffff:192.0.2.10, to IPv4 addresses.
Fixed issues
The 6.5 release also includes the following fixes.
Release 6.5.0
Endpoints from API specifications that declare a variable host now produce one record for each real host, instead of fragmenting the endpoint key.
Defender no longer exceeds its 4Gi memory limit when API specification patterns reload. The Defender connectors now share compiled method and host regular expressions across specification rows, which reduces the memory that a reload requires.
Discovery timestamps from the sensor-side producers now round down to the minute, and an empty discovery log path no longer writes to a directory that Cequence Bridge does not watch.
Defender no longer writes a debug log line for each pattern during specification discovery.
The Go connector no longer leaks memory when it decompresses zstd data.
Defender no longer drops the whole sensor transaction record when raw header names are unavailable.
Defender now clears the fingerprint-v2 map when the mitigator mode is off.
Mitigation policy conditions now evaluate each value of a repeated query parameter individually.
The mitigator's multi-factor authentication credential check now honors the issuer transport configuration, and the finalize endpoint now sets the cookie name that the check reads.
Defender nginx no longer enters a crash loop with the "unknown log format main" error, because Defender now declares the main log format before the included HTTP configuration files reference it.
Defender no longer reports a duplicate status counter.
Policy loading and parsing now handle memory-safety, crash, and silent-behavior conditions correctly.
The mitigator helper's policy fetcher is now more reliable, and the mitigator now handles JWT and issuer reloads through a tested helper.
Defender updates third-party dependencies, including golang.org/x/crypto, golang.org/x/net, and the OpenTelemetry collector, to address image-scan advisories.