# OpenWAF Egress 0.2.1

> A data-plane mode for OpenWAF Cloud, token_sha256, a dial-time SSRF check and /health reporting the real build version.

OpenWAF Egress 0.2.0 and 0.2.1 are out (`ghcr.io/openwaf-dev/egress:0.2.1`, linux/amd64 and linux/arm64). The static `config.json` mode is unchanged; what is new:

- **OpenWAF Cloud data-plane mode.** With `-control-plane`, `-node-id` and `-node-key` the gateway takes agents, targets and policies from OpenWAF Cloud and reports every refused request. `egress keygen` creates the node key.
- **`token_sha256`** in an agent instead of `token`, so the configuration file holds no token; tokens are compared in constant time.
- **SSRF:** the address actually dialed is checked too, and `ssrf_blocked` and `upstream_error` answers no longer carry addresses or connection errors (they are logged).
- **`-trusted-proxies`:** behind a reverse proxy, its `X-Real-IP` is the caller address of block events.
- **`/health`** reports the build version instead of a fixed `0.1.0`.

See the [configuration reference](https://developers.openwaf.dev/egress/configuration/) and the [release notes](https://github.com/openwaf-dev/egress/releases/tag/v0.2.1).