NGINX release notes

1.6.0 2023-04-17

• Added new module configuration option for more granular inspection

1.5.1 2022-10-17

• Added support for Kong 3.0
• Added support for Ubuntu 22.04 (Jammy) (2023-01-17)

1.5.0 2022-01-19

• Improved Content-Type header inspection

1.4.3 2021-07-29

• Added support for Content-type application/graphql
• Standardized release notes (2021-08-31)
• Added Debian 11 support (2021-08-31)

1.4.2 2021-03-10

• Added checksum to sigsci-module-nginx.tar.gz

1.4.1 2021-02-18

• Added cryptographic signatures to released RPM packages

1.4.0 2020-06-25

• Added ability to pass OPTIONS, CONNECT, and all http methods to the agent
• Added ability to allow any waf response code received from agent, 300 to 599 as blocking
• Added support for setting Location header if agent responds with X-Sigsci-Redirect
• Added Ubuntu 20.04 (Focal Fossa) support (2020-09-07)

1.3.1 2020-01-30

• Added Debian 10 (buster) support
• Added CentOS8 (EL8) support

1.3.0 2019-07-12

• Updated module to identify rewritten PreRequests

1.2.9 2019-06-18

• Fixed backward compatibility issue

1.2.8 2019-06-10

• Updated module to identify PreRequests

1.2.7 2019-05-23

• Fixed handling of XML content-type to ensure POST body will be read

1.2.6 2018-10-01

• Added NGINX environment override SIGSCI_NGINX_DISABLE_JIT to disable the JIT
• Added explicit socket close

1.2.5 2018-06-28

• Fixed handling of bad json elegantly rather than error exception

1.2.4 2018-04-26

• Added option to reuse TCP or Unix socket connection when agent -rpc-version=1 is used

1.2.3 2018-04-06

• Added Ubuntu 18.04 (Bionic Beaver) package

1.2.2 2018-03-27

• Added Kong plugin
• Added Debian 9 (stretch) package

1.2.1 2018-01-30

• Added support for multipart/form-data post

1.2.0 2017-10-07

• Improved logging
  • Debug logging performance penalty minimized
  • Ad-hoc data is now JSON encoded for clarity and safety
  • Each message is tagged with NETWORK, DEBUG or INTERNAL
• Updated third-party dependencies to latest
  • rxi/json.lua
  • fperrad/lua-MessagePack
• Standardized defaults across modules and document

1.1.8 2017-09-01

• Fixed module type

1.1.7 2016-12-12

• Disabled debug log by default

1.1.6 2016-12-09

• Cleaned up log_debug output

1.1.5 2016-11-30

• Cleaned up network error logging
• Added log_debug option to aid in debugging
• Added ability to detect and warn for non-LuaJIT installs due to recent compatibility issues

1.1.4 2016-09-01

• Disabled exit if NGINX returns the HTTP method as nil

1.1.3 2016-07-26

• Corrected version number reported by module

1.1.2 2016-07-20

• Added new download option at https://dl.signalsciences.net/sigsci-module-nginx/sigsci-module-nginx_latest.tar.gz

1.1.1 2016-07-14

• Added support for Ubuntu 16.04 (Xenial Xerus)

1.1.0 2016-07-13

• Changed default socket to /var/run/sigsci.sock to allow systemd to work without reconfiguration
• Allowed XML mime types to be passed through to Agent, which allows the Agent to inspect XML documents
• Removed header filtering, as that is now down in the agent, which allows custom rules and other actions on cookie data
• Updated lua-MessagePack to latest
• Fixed NGINX validator script

1.0.0+428 2016-03-16

• Added license information to packages
• Fixed version reporting bug

1.0.0+424 2016-03-15

• Cleaned up some error messages surrounding timeouts
• Fixed bug reading agent responses when -rpc-version=1 is used
• Built additional package formats

1.0.0+417 2016-03-07

• Fixed bug with version reporting in dashboard

1.0.0+416 2016-02-26

• Added backward compatibility support for using the agent RPCv1 protocol (e.g., with -rpc-version=1)

1.0.0+411 2016-02-17

• Originally HTTP methods that were inspected where explicitly listed (allowlisted, e.g. "GET", "POST"). The logic is now inverted to allow all methods not on an ignored list (blocklisted, e.g. "OPTIONS", "CONNECT"). This allows for the detection of invalid or malicious HTTP requests.

1.0.0+408 2016-02-03

• Implemented packaging fixes

1.0.0+407 2016-01-27

• Added support for inspecting HEAD requests
• Improved return speed if post request has an invalid method

1.0.0+388 2015-11-10

• Made network and internal error logging configurable, with network error logging off by default, which will help prevent flooding web server logs with messages if the agent is off or not running
• Allowed "subrequest processed" used in certain configurations of NGINX

1.0.0+378 2015-10-07

• Improved error handling and standardized error message format

1.0.0+369 2015-09-15

• Added ability to optionally allow a site access key to be specified in prerequest and postrequest functions

1.0.0+363 2015-08-24

• Fixed issue of missing server response codes introduced by 361

1.0.0+361 2015-08-17

This was a maintenance release with general improvements

• Added new feature on startup to send a notice message in the error log describing the components used in the module
• Upgraded pure-Lua MessagePack to 0.3.3, which contains minor performance improvements and allows use of various Lua tool chains
• Allowed module to run using plain Lua (not LuaJIT). We strongly recommend LuaJIT as using plain Lua may have severe performance issues. However this does allow options for very low volume servers and aids in debugging.
• Added ability to ensure response time value is non-negative (on machines lacking a monotonic clock and/or clock drift, the value can occasionally go negative)
• Made minor performance improvements and API standardization

1.0.0+346 2015-07-31

• Added ability to send Scheme information to agent (i.e. http or https)
• Added ability to send TLS (SSL) protocol and cipher suite information to agent, upgrade agent to at least 1.8.3385 for best results

1.0.0+344 2015-07-21

• Improved clarity when NGINX is misconfigured

1.0.0+343 2015-07-13

• Enabled setting of request headers from Agent response, requires Agent 1.8.3186 and greater
• Added X-SigSci-RequestID and X-SigSci-AgentResponse request headers, allowing integration with other logging systems
• Fixed "double signal" issue first noticed in 1.0.0+320

1.0.0+327 2015-07-07

• Fixed compatibility to support NGINX version 1.0.15

1.0.0+322 2015-07-06

• Added support for inspection of HTTP PATCH method

1.0.0+320 2015-06-14

• Fixed issues where the Signal Sciences dashboard would show an incorrect "Agent Response" of 0 (for best results, upgrade Agent to at least 1.8.2718)

Known Issues (fixed in 1.0.0+343)

• Requesting a static file, or a missing file, that results with a custom error page may result in "double signal" on the dashboard (i.e., one request generates two entries). This is due to a bug in the NGINX state machine with custom error pages. We are actively working to find a solution.

1.0.0+315 2015-06-11

• Updated to bring module up to latest API specification to enable future features