What's new
ML based API Protection - Schema and Threat Protection
A new protection layer called “Threat Protection” has been added to the ML based API Protection module. It learns parameter value patterns from the API requests body and builds mathematical models to screen out abnormal requests that are deemed malicious.
For more information, see Configuring ML Based API Protection policy.
GraphQL Protection
Protection for GraphQL is introduced in this release. It safeguards GraphQL APIs from malicious queries, signature attacks, and excessive resource consumption, ensuring their secure and efficient operation.
For more information, see Configuring GraphQL protection.
Waiting Room
A new Waiting Room capability is introduced in this release under Application Delivery. It controls visitor traffic using a virtual holding space and queuing First-In/First-Out system.
For more information, see Waiting room.
Advanced Bot Protection policy
FortiGuard Advanced Bot Protection is a SaaS (Software as a Service) solution which builds up a machine learning model to protect against a wide range of threats, including Data harvesting, Credential stuffing attacks, Account takeover attempts, and DDoS attacks
FortiWeb can now integrate with FortiGuard Advanced Bot Protection to leverage its powerful bot detection feature to identify any malicious bot behavior and take appropriate actions.
For more information, see Configuring Advanced Bot Protection policy.
XSW detection
FortiWeb can now detect XML Signature Wrapping (XSW), a technique that enables a malicious client to manipulate or forge a digitally signed document without invalidating the included signature.
For more information, see Creating XSW Detection rules.
DTD validation for XML requests
FortiWeb now supports the utilization of a Document Type Definition (DTD) file to establish restrictions for XML requests.
For more information, see Importing XML DTD files.
External IP Address Auto-Retrieval
In IP Protection > IP List, you now have the option to not only manually specify IP addresses to trust or block but also configure the system to automatically retrieve the IP list from an external HTTP/HTTPS server.
For more information, see IP Address Connector.
Signature Enhancements
We now offer support for utilizing hyperscan to identify personally identifiable information within the response body. To use this feature, simply enable personally-identifiable-information-hyperscan-mode in config waf signature.
Additionally, the signature details now include information about the main category, sub-category, and sensitivity level.
Biometric-based bot detection enhancements
The biometric-based bot detection has been refined to enhance the accuracy of trait collection and URL record logging in attack logs. Traits are now weighted in a more effective manner, improving the efficiency of bot screening while minimizing false positives.
For more information, see Configuring biometrics based detection.
reCAPTCHA v3 support
reCAPTCHA v3 has been integrated in FortiWeb to facilitate bot confirmation. It returns a score for each request without user friction, offering a more flexible configuration and user-friendly experience.
HTTP/2 RST Stream check in HTTP Protocol Constraints
Checking for HTTP/2 RST Stream occurrences and frequency within an HTTP/2 connection is now supported. To set this up, go to Web Protection > Protocol > HTTP > HTTP Protocol Constraints and find the HTTP Request items.
For more information, see HTTP/HTTPS protocol constraints.
Permission-policy in HTTP Header Security
The feature-policy has been updated to permission-policy in alignment with the industry standard. Upgrading is seamless with just one click, and syntax errors can be easily validated.
For more information, see HTTP Security Headers.
Multiple SAML servers in Site Publish
Previously, FortiWeb only supported a single SAML server in Site Publish. Now, it has been upgraded to accommodate multiple SAML servers.
For more information, see Configuring a Security Assertion Markup Language (SAML) server pool.
Cached items search enhancement
In Application Delivery > Caching, we offer the capability to list all cached items associated with a specified URL. Furthermore, you can fine-tune your search by applying keywords to filter the results as needed.
For more information, see Caching.
IP Conflict prompt in event log
If the IP addresses configured on the FortiWeb (including the VIP or network interface IP addresses) conflict with the IP addresses of other devices in the same subnet, an IP conflict event will be recorded in the event log, for instance:
msg="Detect MAC address 08:35:71:fb:f4:cc claims to have our IP 13.0.0.1.
Log type setting for storing or sending logs
You can now choose your preferred log types in the Log & Report > Log Config > Global Log Settings. This allows you to select one or multiple of the three log types (attack log, event log, traffic log) for local storage or forwarding to external log servers.
For more information, see Logging.
Email attachments compression in Email Policy
In this release, we have reinstated the email attachments compression for the alert email policy. With the compression function enabled, event logs and alerts will be attached to the emails in ZIP format; otherwise, they will be attached in TXT format.
For more information, see attach-compress in log email-policy.
HTTP/2 window size limit raised
It is now possible to customize the window size, determining the amount of data in bytes that FortiWeb is willing to receive at any given time, for both the server and client sides of HTTP/2 connections. The valid range is 65,535-2,147,483,647 bytes.
For more information, see http2-window-size in server-policy-server-pool and server-policy-policy.