# OpenWAF Egress 0.2.2

> Strict Bearer parsing with the new invalid_scheme error, WWW-Authenticate on 401, numeric IP literals refused before DNS and configuration checked at startup.

OpenWAF Egress 0.2.2 is out (`ghcr.io/openwaf-dev/egress:0.2.2`, linux/amd64 and linux/arm64). It hardens the gateway:

- **Bearer scheme.** The token is read from `Authorization: Bearer <token>`, with the scheme matched case-insensitively. In config-file mode an `Authorization` header with another scheme, or the bare placeholder without `Bearer`, now answers `401 invalid_scheme`. **Check hand-written HTTP clients** that send `Authorization: OWE_…`: they must send `Authorization: Bearer OWE_…`. SDKs for OpenAI and OpenRouter already do.
- Every `401` carries `WWW-Authenticate: Bearer`.
- **SSRF:** numeric IP spellings such as `2130706433`, `0x7f000001`, `127.1` or `0177.0.0.1` are refused before any DNS lookup (`403 ssrf_blocked`).
- **Configuration checked at startup:** a target without an absolute `http(s)` `base_url` or without `host`, or an agent allowed a target that does not exist, stops the gateway with an error naming it.

See [troubleshooting](https://developers.openwaf.dev/egress/troubleshooting/#all-error-codes) and the [release notes](https://github.com/openwaf-dev/egress/releases/tag/v0.2.2).