Release date 2026/10/12
brute_force_protection is now enforced for principal-based
(Kong Identity) authentication, matching the existing behavior for local
credentials.
brute_force_protection now rate-limits each Proxy-Authorization and Authorization credential independently.
Release date 2026/09/16
Fixed an issue where invalid credentials were not falling back to the configured anonymous consumer when principals.error_on_miss was set to false, unlike every other authentication failure.
Release date 2026/07/02
Added support for authentication via the Kong Identity service with caching, consumer compatibility, and basic analytics.
Release date 2026/10/14
brute_force_protection now rate-limits each Proxy-Authorization and Authorization credential independently.
Release date 2025/12/18
Added brute force protection with exponential backoff for failed login attempts.
Release date 2025/03/27
Improved the error message which occurred when an anonymous consumer was configured but did not exist.
Release date 2024/09/11
Fix an issue of realm field not recognized for older kong versions (before 3.6)
Release date 2024/06/18
Fix an issue of realm field not recognized for older kong versions (before 3.6)
Release date 2024/06/18
Fix an issue of realm field not recognized for older kong versions (before 3.6)
Release date 2024/02/12
Add missing WWW-Authenticate headers to 401 response in basic auth plugin.
Release date 2022/12/06
The anonymous field can now be configured as the username of the consumer. This field allows you to configure a string to use as an “anonymous” consumer if authentication fails.
Release date 2022/09/09
Updated the priority for some plugins.: basic-auth changed from 1001 to 1100
