# DataDome Nginx Module

# 2.49.0 (2024-12-05)

- Add `data_dome_auth_enable_referrer_restoration` option to enable the referrer restoration
- Use the `X-Forwarded-Proto` header when available to define the `Protocol` field in payloads sent to the Protection API
- Use uppercase letters for hexadecimal values in payloads sent to the Protection API
- Make parsing case-insensitive for header names

## 2.48.0 (2024-10-24)

- Add support for collecting `JA4` headers passed to the module for detection enhancement

## 2.47.0 (2024-09-23)

- Collect JA3 fingerprint

## 2.46.1 (2024-06-04)

- Adjust default exclusion pattern for static files

## 2.46.0 (2024-03-05)

- Collect `x-userid` header
- Fix `Content-Type` header truncation size
- Fix `Sec-CH-UA-Mobile` header truncation size

## 2.45.0 (2023-03-06)

- Change default log level to WARN
- Add env variable to switch back to ERROR

## 2.44.0 (2023-01-25)

- Collect Fetch Metadata headers (Sec-Fetch-*)

## 2.43.1 (2022-11-15)

- Fixed typo in payload field name (XForwardedForIp)
- Switched to semantic versioning

## 2.43 (2022-10-24)

- Updated default regex exclusion
- Collect more headers

## 2.42 (2022-07-01)

- Added support for nginx 1.23.0

## 2.41 (2022-02-11)

- Added support for session by header

## 2.40 (2021-10-14)

- Improved stability on nginx 1.13.10+ in rare cases

## 2.39 (2020-12-02)

- Prevetted worker process is shutting down for long time

## 2.38 (2020-08-05)

- Improved stability of our modules for nginx 1.13.10+ at some very rare cases

## 2.37 (2020-06-24)

- Improved stability of `dd_server` on extreamly small DNS' TTL

## 2.36 (2019-03-19)

- Silenced-Wcast-function-type warnings

## 2.35 (2018-11-20)

- decreased DNS response TTL from 1 hour to 5 minutes

## 2.34 (2018-05-10)

- Included headers to ApiServer's call: Content-Type, From, X-Real-IP, Via and True-Client-IP
- Changed the logic to truncate X-Forwarded-For from beginning

## 2.33 (2017-08-07)

- Introduced support 401 response code from the API Server

## 2.32 (2017-04-12)

- Introduced data_dome_auth_set

## 2.31 (2017-03-24)

- Reduce traffic size between module and APIServer

## 2.30 (2017-03-21)

- Added compatibility with nginx before 1.5.8, 1.5.6 and 1.5.3
- Removed warnings for nginx before 1.9.11

## 2.29 (2017-03-16)

- Implemented support X-DataDome-request-Headers

## 2.28 (2017-02-08)

- Don't mark as inactive API server's backend for 10 second in case of any error

## 2.27 (2016-12-09)

- Added verification by X-DatadomeResponse header
- Sent request's headers name to the API server
- Sent request's Connection, Pragma and Cache-Control header's value

## 2.26 (2016-11-30)

-  `data_dome_auth` supports disable processing request by setting 'off' up over variable

## 2.25 (2016-11-25)

- Fixed possible segfault on large API server response
- data_dome_auth directive accepts variables

## 2.24 (2016-11-04)

- Sync version

## 2.23 (2016-10-18)

- Fixed default exclusion regex for match file likes some.min.css

## 2.22 (2016-09-26)

- correct truncate url encoded value

## 2.21 (2016-09-21)

- Decreased the maximum API call to 10kb

## 2.20 (2016-09-13)

- Add .mp4 and .otf to default exclusion regex

## 2.19 (2016-08-08)

- Remove all code that can read request body
- Add regex exclusion

## 2.18 (2016-07-27)

- Send Content-Length header as PostParamLen

## 2.17 (2016-06-29)

- Disable send Cookies and Body to API server by default
- Add debug_params option
- Send Cookies length and Body length to API server
- Send Authorization length
- Send Method
- Send X-Requested-With
- Send Origin

## 2.16 (2016-06-28)

- Added debug mode

## 2.15 (2016-06-23)

- Add url encoding to API call parametrs
 
## 2.14 (2016-06-03)

- Fix param truncate logic

## 2.13 (2016-04-25)

- Don't overwrite Set-Cookie header.

## 2.12 (2016-04-15)

- Module don't generate ClientID
- Remove X-DataDome header with module version
- Support X-DataDome-headers from API response

## 2.11 (2016-04-09)

- Implemented dynamic server based on https://github.com/GUI/nginx-upstream-dynamic-servers
- Implemented $data_dome_auth_is_uri_regex_matched variable
- Add X-DataDome header with module version

## 2.10 (2016-04-07)

- Add support dynamic module

## 2.9 (2016-03-31)

- Don't call the API server several times

## 2.8 (2016-03-30)

- Finalize request after send API server response

## 2.7 (2016-03-29)

- don't finalize HTTP request two time with different status

## 2.6 (2016-01-28)

- re-generate client ID if it shortest or longest what expected

## 2.5 (2016-01-08)

- fixed bug when nginx doesn't sent response to client when API server responsed not 200 without a body

## 2.4 (2016-01-08)

- synchronize version with apache and varnish module

## 2.3 (2016-01-06)

- fixed build with IPv6
- fixed build on GCC-4.8
- fixed post_param_limit
- don't send '\0' as end of one of parametrs to API Server call
- uses ip address for client id generation if can't parse X-Forwarder-For
- memzero new headers and potentian crash
- fixed potential connection leaks
- sent to client API response for 301, 302 and 403 response
- sent to client location from API response for 301 and 302 response
 
## 2.2 (2015-12-10)

- fixed crash X-Forwarder-For without port
- don't send empty parameter anymore

## 2.1 (2015-12-02)
 
- Regex only apply to URL, not to MIME anymore

## 2.0 (2015-11-30)

- Cookie and session ID implementation
- Extract more from Header : Accept, AcceptCharset, AcceptEncoding and AcceptLanguage
