WAF features
FortiWeb now supports the HTTP/3 protocol for the traffic between FortiWeb and the client in Reverse Proxy mode.
Threat Protection model update
We have introduced a major update to the Threat Protection model. The update is done after long research and testing using large amounts of data for model training. The new update increases model accuracy and reduce false positives and false negatives. We will continue to collect more data to further refine the model. Future updates will be published along with the FDS updates.
Built-in allowed domains in MiTB protection
To simplify the configuration process, we have included a built-in list of well-known third-party external resources which would be used through AJAX request. The suggested list is available in the Allowed External Domains for AJAX Request table of Man in the Browser Protection module.
AJAX check for cross-site request forgery (CSRF) requests
Previously, we supported checking the CSRF attacks that exploit static links in the page, such as <a> and <form> tags. Starting from version 7.6.0, we can also scan the CSRF requests using JavaScript XMLHttpRequests embedded in the page, also known as AJAX requests.
DoS Protection Exception Policy
You can create an exception policy to omit DDoS attack scans when you know that some source IPs may trigger positives during normal use. The exception policy can be applied in Dos Protection Policy, HTTP Access Limit, Malicious IPs, HTTP Flood, and TCP Flood policy.
Obscuring sensitive data in the gRPC API responses
For gRPC API traffic, FortiWeb now supports obscuring sensitive data in server's response if it matches the Information Disclosure and Personally Identifiable Information signatures.
Previously, Known Good Bots had only one category - "Known Search Engines". Starting from version 7.6.0, we have added more good bots to the list and divided them into smaller groups for better management. You can now set different actions for different Known Good Bots sub-categories.
We have implemented the following enhancements to the URL Rewrite module.
-
Cookie removal from HTTP header based on cookie name.
-
Cookie value insertion or replacement based on cookie name.
-
HTTP body replacement
The "deflate" compression type supported
FortiWeb now supports the "deflate" compression type. "Deflate" files can be uncompressed and scanned against the security modules to ensure their legitimacy.
For the Trusted X-Header Sources table in Server Objects > X-Forwarded-For, we have removed the previous limitation of 256 IP address entries. Now, you can define IP ranges and IP groups within this table.
Customizing waiting room display page
Now you have the option to customize the message displayed to users when they are placed in the waiting room. This feature allows you to tailor the text to better align with your brand or provide specific instructions to users during their wait.
Quarantine IP settings moved to Security Fabric > Fabric Connectors
In previous versions, Quarantine IP was configured through System > Config > FortiGate Integration. To ease configuration, this feature can now be configured through Security Fabric > Fabric Connectors.
We have enhanced the 500 error page to provide detailed information explaining why requests are blocked when they violate the HTTP Protocol Constraints (HPC) security rules.
Signature scan for uploaded files
It's now supported to perform a signature scan for the files uploaded by the clients. Enable it in Web Protection > Input Validation > File Security > File Security Policy.