Tyk Gateway v5.0.9

Fixed

• Fixed a bug that was introduced in the fix applied to the URL Rewrite middleware in Tyk 5.0.5/5.1.2. The previous fix did not correctly handle escaped characters in the query parameters. Now you can safely include escaped characters in your query parameters and Tyk will not modify them in the URL Rewrite middleware.
• Enhanced management of custom keys in edge gateway mode. When a key is modified using its custom identifier, the update is now accurately propagated to the edge gateway.
• Fixed a bug where the gateway didn't correctly apply Path-Based Permissions from different policies when using the same sub claim but different scopes in each policy. Now the session will be correctly configured for the claims provided in the policy used for each API request.
• Fixed an issue where the Validate Request middleware provided too much information when reporting a schema validation failure in a request to a Tyk OAS API.

Tyk Dashboard v5.0.9

Fixed

• Fixed an issue where TLS 1.3 was not offered as an option in the "Minimum TLS version" dropdown in the API Designer. Also we now give better (human readable) names to the options, such as TLS 1.0, TLS 1.1 etc. instead of their corresponding numbers 769, 770 etc.
• Implemented a tyk version command that provides more details about the Tyk Dashboard build. This prints the release version, git commit, Go version used, architecture and other build details.
• Fixed minor issues in the Dashboard UI when configuring the user access controls for the Identity Management (TIB) and Real Time Notifications permissions.
• Fixed a situation where Tyk Dashboard could panic when using the mongo-go driver
• Fixed two UI issues with the Open Policy Agent editor in the Tyk Dashboard to improve experience when using this feature. Scrolling beyond the end of the OPA window does not now start to scroll the API Designer window, and minimising then re-expanding the OPA editor no longer limits the text to one line.
• Improved the error message that is returned when a user tries to update a Tyk OAS API using a Tyk Classic API endpoint when allow_unsafe_oas is not enabled.

Tyk Gateway v5.2.4

Fixed

• Fixed a bug that was introduced in the fix applied to the URL Rewrite middleware in Tyk 5.0.5/5.1.2. The previous fix did not correctly handle escaped characters in the query parameters. Now you can safely include escaped characters in your query parameters and Tyk will not modify them in the URL Rewrite middleware.
• Enhanced management of custom keys in edge gateway mode. When a key is modified using its custom identifier, the update is now accurately propagated to the edge gateway.
• Fixed a bug when using the build_id argument with the Tyk Plugin Compiler that prevents users from hot-reloading different versions of the same plugin compiled with different build_id. The bug was introduced with the plugin module build change implemented in the upgrade to Go version 1.19 in Tyk 5.1.0.
• Fixed a bug where the gateway didn't correctly apply Path-Based Permissions from different policies when using the same sub claim but different scopes in each policy. Now the session will be correctly configured for the claims provided in the policy used for each API request.
• Fixed an issue where the Validate Request middleware provided too much information when reporting a schema validation failure in a request to a Tyk OAS API.

Tyk Dashboard v5.2.4

Fixed

• Fixed an issue where TLS 1.3 was not offered as an option in the "Minimum TLS version" dropdown in the API Designer. Also we gave better (human readable) names to the options, like TLS 1.0, TLS 1.1 etc. instead of their corresponding numbers 769, 770 etc.
• Implemented a tyk version command that provides more details about the Tyk Dashboard build. This prints the release version, git commit, Go version used, architecture and other build details.
• Fixed "Cannot access 'writePanelHeightToLocalStorage' before initialization" error by reordering function declarations.
• Fixed minor issues in the Dashboard UI when configuring the user access controls for the Identity Management (TIB) and Real Time Notifications permissions.
• Fixed a situation where Tyk Dashboard could panic when using the mongo-go driver
• Fixed two UI issues with the Open Policy Agent editor in the Tyk Dashboard to improve experience when using this feature. Scrolling beyond the end of the OPA window does not now start to scroll the API Designer window, and minimising then re-expanding the OPA editor no longer limits the text to one line.
• Improved the error message that is returned when user tries to update a Tyk OAS API using a Tyk Classic API endpoint when allow_unsafe_oas is not enabled.

Tyk Gateway v5.2.3

Fixed

• Improved the behaviour when using JWTs if the MDCB (Multi Data Centre Bridge) link is down: the Gateway will no longer be blocked attempting to fetch OAuth client info. We’ve also enhanced the error messages to specify which type of resource (API key, certificate, OAuth client) the data plane Gateway failed to retrieve due to a lost connection with the control plane.
• Fixed an issue where the session object generated when creating a Custom Key in a Go Plugin did not inherit parameters correctly from the Security Policy.
• Fixed a minor issue with Go Plugin virtual endpoints where a runtime log error was produced from a request, even if the response was successful. Thanks to @uddmorningsun for spotting this and proposing a fix.
• Fixed a bug where a customer could accidentally provide a Public Key instead of a Certificate to an mTLS request. This would bring down all the Gateways it’s published on, making them unresponsive to any attempt to communicate over HTTPS. Now Tyk will not announce the Public Key during the mTLS handshake.
• Fixed a bug where Tyk would not automatically detect the installed Python version if that had multiple digits in the minor version (e.g. Python 3.11).
• Bumped golang.org/x/net to 0.17.0, updating the direct dependency to partially resolve CVE-2023-44487. As Go embeds this in the standard library, we only partially resolve the CVE due to an older Go version in use. To mitigate the vulnerability, users are advised to disable HTTP/2 at this time by setting enable_http2 to false.

Added

• Implemented a tyk version command that provides more details about the Tyk Gateway build. This prints the release version, git commit, Go version used, architecture and other build details.
• Implemented a backoff limit for GQL subscription connection retry. Previously the Gateway was attempting to reconnect endlessly, with this limit the reconnection attempts will happen in the following intervals: 2s, 4s, 8s, 16s and 32s and after that the Websocket connection will be closed.
• Added a new option for Tyk to use the default version of an API if the requested version does not exist. This is referred to as falling back to default and is enabled using a configuration flag in the API defintion; for Tyk OAS APIs the flag is fallbackToDefault, for Tyk Classic APIs it is fallback_to_default.

Tyk Dashboard v5.2.3

Fixed

• Fixed a bug in the Tyk Dashboard API where passing a non-integer value as the pagination query parameter p to the /api/logs endpoint could lead to an out-of-memory scenario as the Dashboard would attempt to retrieve all logs in the system. Tyk will now return an HTTP 400 Bad Request response if a non-integer value is provided. This fix mitigates the risk of accidentally or deliberately causing Tyk Dashboard to stop responding.
• Fixed a bug in the API Designer that prevented dragging to re-size the OPA editor.
• Fixed a bug where searching for a User in the Tyk Dashboard didn't match partial user names.
• Fixed a bug where Tyk Dashboard was unable to retrieve certificates from a Tyk Gateway if the Gateway version was <4.1 and Dashboard version was >=4.1. This was due to a change made in the 4.1 versions to the way certificate details are retrieved in dashboard; in the newer versions, we can view more detail of the certificates. Now you can use Tyk Dashboard with any version of the Tyk Gateway and still retrieve and view certificate details.
• Fixed a bug in the Tyk Classic API Designer where if you changed the protocol for an API (for example from HTTP to HTTPS) then the authentication mechanism would be automatically set to Authentication Token.
• Fixed a bug in the Tyk Classic API Designer where it was not possible to configure External OAuth authentication for an API using the Raw API Definition screen. The Dashboard would always set use_standard_auth to true, which actually enables Auth Token authentication.
• Fixed a bug with failed GQL subscriptions between the upstream and the Dashboard UI. When an upstream subscription was disconnected and later reconnected, the UI did not update to reflect the reconnection, preventing the seamless consumption of messages. Now the Dashboard UI can continue consuming messages after upstream reconnects.

Tyk Gateway v5.0.8

Fixed

• Improved Error Messaging: Enhanced the error messages to specify which type of resource (API keys, certs, OAuth clients) failed to sync from MDCB due to lost connection.
• Fixed a bug which ensures that the Response Body Transform now correctly applies when using Persist GraphQL. Previously when using Persist GraphQL and Body Transform middleware in conjunction, there was a problem with modifying the response correctly.
• Fixed a bug we've implemented a backoff limit for GQL subscription connection retry. Previously the Gateway was attempting to reconnect endlessly, with this limit the reconnection attempts will happen in the following intervals: 2s, 4s, 8s, 16s and 32s and after that the Websocket connection will be closed.
• Fixed a bug by Implemented a tyk version command that provides more details about the Tyk Gateway build. This prints the release version, git commit, Go version used, architecture and other build details. It's used to provide more detailed information when raising support tickets, as well as facilitating some CI automation with the use of --json flag.
• Fixed an issue where the session object generated when creating a Custom Key in a Go Plugin did not inherit parameters correctly from the Security Policy.
• Fixed a minor issue with Go Plugin virtual endpoints where a runtime log error was produced from a request, even if the response was successful. Thanks to @uddmorningsun for spotting this and proposing a fix.
• Fixed a bug where a customer could accidentally provide a Public Key instead of a Certificate to an mTLS request. This would bring down all the Gateways it’s published on, making them unresponsive to any attempt to communicate over HTTPS. Now Tyk will not announce the Public Key during the mTLS handshake.

Tyk Dashboard v5.0.8

Fixed

• Fixed a bug where passing a non-integer value as the pagination query parameter p to the /api/logs endpoint could lead to an out-of-memory scenario as the Dashboard would attempt to retrieve all logs in the system. Tyk will now return an HTTP 400 Bad Request response if a non-integer value is provided. This fix mitigates the risk of accidentally or deliberately causing Tyk Dashboard to stop responding.
• Fixed a bug in the OPA editor that prevented dragging has been fixed.
• Fixed a bug where searching for a User in the Tyk Dashboard didn't match partial user names.
• Fixed a bug where Tyk Dashboard was unable to retrieve certificates from a Tyk Gateway if the Gateway version was <4.1 and Dashboard version was >=4.1. This was due to a change made in the 4.1 versions to the way certificate details are retrieved in dashboard; in the newer versions, we can view more detail of the certificates. Now you can use Tyk Dashboard with any version of the Tyk Gateway and still retrieve and view certificate details.
• Fixed a bug in the Tyk Classic API Designer where if you changed the protocol for an API (for example from HTTP to HTTPS) then the authentication mechanism would be automatically set to Authentication Token.
• Fixed a bug in the Tyk Classic API Designer where it was not possible to configure External OAuth authentication for an API using the Raw API Definition screen. The Dashboard would always set use_standard_auth to true, which actually enables Auth Token authentication.
• Fixed a bug with failed GQL subscriptions between the upstream and the Dashboard UI. When an upstream subscription was disconnected and later reconnected, the UI did not update to reflect the reconnection, preventing the seamless consumption of messages. Now the Dashboard UI can continue consuming messages after upstream reconnects.

Tyk Gateway v5.2.2

Fixed

• Fixed an issue where the Tyk Gateway logs would include sensitive information when the incorrect signature is provided in a request to an API protected by HMAC authentication.
• Fixed a performance issue where JWT middleware introduced latency which significantly reduced the overall request/response throughput.
• Fixed a performance issue encountered when Tyk Gateway retrieves a key via MDCB for a JWT API. The token is now validated against JWKS or the public key in the API Deinfition.
• Fixed a potential race condition where the DRL manager was not properly protected against concurrent read/write operations in some high load scenarios.
• Fixed High Priority CVEs identified in Tyk Gateway.
• Fixed a bug where a duplicate error message was returned when a custom Go Plugin returned an error. Thanks to @PatrickTaibel for highlighting the issue and suggesting a fix.
• Implemented ULID Normalization, replacing valid ULID identifiers in the URL with a {ulid} placeholder for analytics. This matches the existing UUID normalization. Thanks to @atkrad for the contribution.
• Fixed an issue where enforced timeout values were incorrect on a per-request basis. Since we enforced timeouts only at the transport level and created the transport only once within the value set by max_conn_time, the timeout in effect was not deterministic. Timeouts larger than 0 seconds are now enforced for each request. The default value of proxy_default_timeout is now set to 30s. It previously used to wait forever.

Tyk Dashboard v5.2.2

Fixed

• Embeded TIB v1.4.2 which fixed SSO Integration: Resolved issues affecting SAML and Azure-based Single Sign-On authentication.
• Added a new Dashboard configuration option allow_unsafe_oas. This permits the modification of Tyk OAS APIs via the Tyk Classic API endpoints. This is not recommended action due to the risk of inconsistent behaviour and potential for breaking changes while Tyk OAS is in Early Access. This is provided for early adopters and will be deprecated later, once Tyk OAS reaches full maturity.
• Fixed a security vulnerability with the Tyk Dashboard API where the api_version and api_id query parameters were potential targets for SQL injection attack.
• Fixed an issue encountered with the API Designer where fields defined in uptime_tests.check_list were not correctly handled. Uptime tests can now be configured for Tyk Classic APIs using the Raw API Definition editor.
• Fixed a problem for Azure SAML2.0 Identity provider that prevented users from authenticating.
• Fixed High Priority CVEs identified in Tyk Dashboard.
• Fixed an issue in the Dashboard Service Uptime page where the number of success hits was being incorrectly reported as the total number of hits, inclusive of failures. After this fix, the Success Column displays only the number of success hits.
• Fixed an issue where Tyk would not store the Policy Id in the API Definition for a policy that did not exist. When using JWT Authentication, the JWT Default Policy Id is stored in the API Definition. If this policy had not been created in Tyk at the time the API Definition was created, Tyk Dashboard would invalidate the field in the API Definition. When the policy was later created, there would be no reference to it from the API Definition. This was a particular issue when using Tyk Operator to manage the creation of assets on Tyk.
• Fixed an issue in the Tyk Dashboard where a user might not correctly inherit all permissions from their user group, and could incorrectly be granted visibility of Identity Management.
• Fixed an issue when using MongoDB and Tyk Security Policies where Tyk could incorrectly grant access to an API after that API had been deleted from the associated policy. This was due to the policy cleaning operation that is triggered when an API is deleted from a policy in a MongoDB installation. With this fix, the policy cleaning operation will not remove the final (deleted) API from the policy; Tyk recognises that the API record is invalid and denies granting access rights to the key.
• On the Licensing Statistics screen we have renamed the Licence Limit to Licence Entitlement. We’ve also improved the experience when there is no limit in the licence by hiding the Licence Entitlement line if no limit is set.

Tyk Gateway v5.0.7

Fixed

• Fixed an issue where the Tyk Gateway logs would include sensitive information when the incorrect signature is provided in a request to an API protected by HMAC authentication.
• Fixed a performance issue where JWT middleware introduced latency which significantly reduced the overall request/response throughput.
• Fixed a performance issue when Tyk Gateway retrieves a key via MDCB for a JWT API. The token is now validated against JWKS or the public key in the API Definition.
• Fixed a potential race condition where the DRL manager was not properly protected against concurrent read/write operations in some high load scenarios.
• Fixed High Priority CVEs identified in Tyk Gateway.
• Fixed a bug where a duplicate error message was returned when a custom Go Plugin returned an error. Thanks to @PatrickTaibel for highlighting the issue and suggesting a fix.
• Fixed an issue where enforced timeout values were incorrect on a per-request basis. Since we enforced timeouts only at the transport level and created the transport only once within the value set by max_conn_time, the timeout in effect was not deterministic. Timeouts larger than 0 seconds are now enforced for each request. The default value of proxy_default_timeout is now set to 30s. It previously used to wait forever.

Tyk Dashboard v5.0.7

Fixed

• Embeded TIB v1.4.2 which fixed SSO Integration: Resolved issues affecting SAML and Azure-based Single Sign-On authentication.
• Added a new Dashboard configuration option allow_unsafe_oas. This permits the modification of Tyk OAS APIs via the Tyk Classic API endpoints. This is not recommended action due to the risk of inconsistent behaviour and potential for breaking changes while Tyk OAS is in Early Access. This is provided for early adopters and will be deprecated later, once Tyk OAS reaches full maturity.
• Fixed a security vulnerability with the Tyk Dashboard API where the api_version and api_id query parameters were potential targets for SQL injection attack.
• Fixed an issue encountered with the API Designer where fields defined in uptime_tests.check_list were not correctly handled. Uptime tests can now be configured for Tyk Classic APIs using the Raw API Definition editor.
• Fixed a problem for Azure SAML2.0 Identity provider that prevented users from authenticating.
• Fixed High Priority CVEs identified in Tyk Dashboard.
• Fixed an issue in the Dashboard Service Uptime page where the number of success hits was being incorrectly reported as the total number of hits, inclusive of failures. After this fix, the Success Column displays only the number of success hits.
• Fixed an issue where Tyk would not store the Policy Id in the API Definition for a policy that did not exist. When using JWT Authentication, the JWT Default Policy Id is stored in the API Definition. If this policy had not been created in Tyk at the time the API Definition was created, Tyk Dashboard would invalidate the field in the API Definition. When the policy was later created, there would be no reference to it from the API Definition. This was a particular issue when using Tyk Operator to manage the creation of assets on Tyk.
• Fixed an issue in the Tyk Dashboard where a user might not correctly inherit all permissions from their user group, and could incorrectly be granted visibility of Identity Management.
• Fixed an issue when using MongoDB and Tyk Security Policies where Tyk could incorrectly grant access to an API after that API had been deleted from the associated policy. This was due to the policy cleaning operation that is triggered when an API is deleted from a policy in a MongoDB installation. With this fix, the policy cleaning operation will not remove the final (deleted) API from the policy; Tyk recognises that the API record is invalid and denies granting access rights to the key.

Tyk Gateway v4.0.15

Fixed

• Fixed bug where HMAC authentication gives sensitive info in logs.

Tyk Gateway v5.2.1

Fixed

• Fixed a memory leak issue in Gateway 5.2.0 if opentelemetry is enabled. It was caused by multiple otelhttp handler being created. We have updated to use single instance of otelhttp handler in 5.2.1 to improve performance under high traffic load.
• Fixed a memory leak that occurred when setting the strict routes option to change the routing to avoid nearest-neighbour requests on overlapping routes (TYK_GW_HTTPSERVEROPTIONS_ENABLESTRICTROUTES)
• Updated panic message from Spanish to English
• Fixed a bug where missing http.response.body.size and http.request.body.size attributes to both Tyk HTTP span and upstream HTTP span. It is to allow users to have visibility on request and response size from the traces.
• Fixed a bug where the Gateway did not correctly close idle upstream connections (sockets) when configured to generate a new connection after a configurable period of time (using the max_conn_time configuration option). This could lead to the Gateway eventually running out of sockets under heavy load, impacting performance.
• Fixed a bug where HTTP APIs, when Persist GraphQL middleware was configured in conjunction with Response body transform, the body transformation of the response was not applied.
• Fixed a bug during Gateway reload where the Gateway would continue to load new API definitions even if policies failed to load; this would leave the customer at risk of an APIs being invoked without the correct policies having been loaded. Now Tyk will make a configurable number of attempts to load resources (APIs and policies) before continuing. If a resource fails to load, an error will be reported in the log and the Gateway will cancel the reload reverting to its previously working resource configuration. We have introduced two new variables to configure this behaviour: resource_sync.retry_attempts defines the number of retries that the Gateway should perform during a resource sync (APIs or policies), defaults to zero which means no retries are attempted resource_sync.interval configures the fixed interval between each retry attempt (in seconds)
• Remove the extra chunked transfer encoding that was added to rawResponse analytics
• Fixed a bug where, if you created a Key which provided access to an inactive or draft API, you would be unable to subsequently modify that Key (via the Dashboard or directly via the Tyk Gateway API)
• Fixed a potential performance issue related to high rates of Gateway reloads (when the Gateway is updated due to a change in APIs and/or policies). The gateway uses a timer that ensures there at least one second between reloads, however in some scenarios this could lead to poor performance (for example overloading Redis). We have introduced a new configuration option reload_interval that can be used to adjust the duration between reloads and hence optimise the performance of your Tyk deployment.
• Fixed a bug where headers not being passed upstream for GQL/UDG subscriptions

Tyk Dashboard v5.2.1

Fixed

• Fixed a bug where "Add GraphQL Operation" tickbox could not be disabled in GQL data source configuration screen, even if no operation was added. Now it's possible to change its state depending on the presence of GQL operation and variables.
• Fixed a bug in the Dashboard UI where pagination was breaking for lists using GraphQL requests
• Fixed the Tyk Dashboard API so that Tyk Sync can fully support Tyk OAS APIs; this will be enabled from Tyk Sync version 1.4.1.

Tyk Gateway v5.0.6

Fixed

• Fixed a memory leak that occurred when setting the strict routes option to change the routing to avoid nearest-neighbour requests on overlapping routes (TYK_GW_HTTPSERVEROPTIONS_ENABLESTRICTROUTES)
• Improve the messages quality by remove useless msgs
• Fixed a bug where allowed/blocked IP validation error in API definition suppressed all other API definition validation errors
• Fixed a bug where the Gateway did not correctly close idle upstream connections (sockets) when configured to generate a new connection after a configurable period of time (using the max_conn_time configuration option). This could lead to the Gateway eventually running out of sockets under heavy load, impacting performance.
• Fixed a bug during Gateway reload where the Gateway would continue to load new API definitions even if policies failed to load; this would leave the customer at risk of an APIs being invoked without the correct policies having been loaded. Now Tyk will make a configurable number of attempts to load resources (APIs and policies) before continuing. If a resource fails to load, an error will be reported in the log and the Gateway will cancel the reload reverting to its previously working resource configuration. We have introduced two new variables to configure this behaviour: resource_sync.retry_attempts defines the number of retries that the Gateway should perform during a resource sync (APIs or policies), defaults to zero which means no retries are attempted resource_sync.interval configures the fixed interval between each retry attempt (in seconds)
• Remove the extra chunked transfer encoding that was added to rawResponse analytics
• Fixed a potential performance issue related to high rates of Gateway reloads (when the Gateway is updated due to a change in APIs and/or policies). The gateway uses a timer that ensures there at least one second between reloads, however in some scenarios this could lead to poor performance (for example overloading Redis). We have introduced a new configuration option reload_interval that can be used to adjust the duration between reloads and hence optimise the performance of your Tyk deployment.

Tyk Dashboard v5.0.6

Fixed

• Fixed the Tyk Dashboard API so that Tyk Sync can fully support Tyk OAS APIs; this will be enabled from Tyk Sync version 1.4.1.
• Emit a signal of API change when the OAS migration script is executed, to notify data planes about the change in API structure in database
• Fixed a bug where a negative value could be provided in the Enforced Timeout configuration
• Fix Log Browser performance issue with MongoDB. It should display logs for selected time period only.
• Fixed a bug where the Dashboard would not allow you to modify a key that provides access rights to an inactive API
• Fixed a bug in the Gateway usage chart in Dashboard analytics when selecting the "show analytics for " dropdown option
• Fix: User should use URL-encoded values in username and password of a MongoDB connection string if it contains following characters - "?", "@". The same connection string should always be accepted by both mgo and mongo-go drivers.