Kong Gateway 3.9: Extended AI Support and Enhanced Security
Today we're excited to announce Kong Gateway 3.9!
Since unveiling Kong Gateway 3.8 at API Summit 2024 just a few months ago, we’ve been busy making important updates and improvements to Kong Gateway. This release introduces new functionality around LLM support for AI governance and security and threat protection. Keep reading to learn more!
Make your organization even more AI-ready: Added support for 1M+ new AI models and agentic workflows
With the Kong Gateway 3.9 release, we also shipped new improvements to our AI Gateway. This new release ships with support for a new GenAI provider, Hugging Face, providing users with access to more than 1.1 million new AI models. You'll be able to easily secure, observe, and govern the Hugging Face models via the Kong AI Gateway in the same way you are currently able to do so for GCP Vertex, AWS BedRock, Azure AI, OpenAI, Mistral, Antrophic, Cohere, and more.
Support for AI agentic workflows has also been significantly improved by enhancing AI Gateway’s function-calling capabilities across every GenAI provider. Building chatbots, AI agents, and "copilot" capabilities has never been easier while ensuring governance, security, speed, and observability via the AI capabilities available through Kong's AI Gateway.
Enhanced security and threat protection: Injection protection and more advanced rate limiting
Given how mission-critical API security is from a tech and financial perspective, we decided to further our API security offering with new API security functionality: injection protection and service-level rate limiting.
Injection protection (Enterprise only)
An injection attack is a type of security vulnerability where an attacker exploits flaws in a system to inject malicious data or code into a program, query, or request. The goal is to manipulate the system's behavior, often to gain unauthorized access, retrieve sensitive information, or execute malicious actions.
There are several different kinds of injection attacks (SQL, XSS, etc.), and now you can use Kong to protect your organization from these malicious threat vectors.
Kong Gateway can now enforce injection protection policies, all powered by the new Injection Protection plugin. This new enterprise plugin is designed to cover a wide range of common injection patterns, such as SQL, XSS, Server-side include, XPath Syntax, and Java Exception — all out of the box. The plugin will extract information from request headers, path, query, or body payload parameters and evaluate that content against pre-defined regular expressions. If the content matches any of the patterns, the request is flagged as malicious and blocked.
If our default patterns don't meet your needs, you can define custom patterns and have the gateway validate requests against those as well. This gives you the power to customize the injection protection plugin to fit the unique API security needs of your organization.
Learn more about getting started with the Injection Protection plugin on the Kong blog, or head over to the plugin documentation.
Advanced rate limiting and service protection
Rate limiting is "bread-and-butter" API gateway functionality and is key in making sure that API traffic is secure, reliable, and performant.
Gateway 3.9 expands the scope of Kong rate limiting, allowing you to enforce fine-grained rate limits and access controls at the service level. While service-level rate limiting was already possible by combining the existing rate-limiting plugin with the advanced rate-limiting plugin, the addition of this new plugin makes it possible to enforce multiple rate limits for a single API at both the service and route level, eliminating the need to run two rate-limiting plugins.
The new Service protection plugin enables this. To learn more and get started, check out the plugin documentation.
Getting started with Kong Gateway 3.9
Start with Kong Gateway 3.9 by signing up for Kong Konnect for free. Or, if you want to try Kong Gateway Enterprise 3.9, you can explore the options for getting started here.
To explore the comprehensive list of features, fixes, and updates, please see the available CHANGELOG for Kong Gateway Enterprise here.
Power your APIs with Kong Gateway
