Prev |  | Next

## Appendix C. Migrating from Cowboy 2.14 to 2.15

Cowboy 2.15 fixes a number of security vulnerabilities. It also has a few new options for HTTP/1.1.

Cowboy 2.15 updates Cowlib to 2.16.1. Both applications must be updated as they both contain security fixes.

Cowboy 2.15 requires Erlang/OTP 24.0 or greater.

## C.1. Features added

- The `max_authorization_header_value_length` and `max_cookie_header_value_length` options were added to HTTP/1.1. They allow more fine-grained control over header value lengths.

## C.2. Bugs fixed

- A number of security vulnerabilities have been fixed, including a possible denial of service in the HTTP/1.1 parser.
- Update Cowlib to 2.16.1.
- HTTP/2 Websocket did not call `terminate/3` on abrupt socket close (without a close frame being sent first). This is now fixed. Do note however that the Websocket session process must trap exits to call `terminate/3`. This was fixed since Cowboy 2.14.1.

Prev | Up | Next
| Home |