> For the complete documentation index, see [llms.txt](https://coldbox-security.ortusbooks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://coldbox-security.ortusbooks.com/readme/release-history/whats-new-with-3.0.0.md).

# What's New With 3.0.0

January 2023

<figure><img src="https://2859563563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQRx6Yt4XoVCeRC7Rgbxy%2Fuploads%2Fjn2iX5l0ccBpWTCqSKip%2FCBSecurity-M-darkbg.png?alt=media&amp;token=273c2007-96d2-4258-9eeb-043c7658db1b" alt=""><figcaption><p>v3.x Release</p></figcaption></figure>

### Compatibility

* Dropped Adobe ColdFusion 2016
* New **`JwtAuthValidator`** instead of mixing concerns with the `JwtService`. You will have to update your configuration to use this `validator` instead of the `JwtService`
* All settings have changed. They are not single-level anymore. They are now grouped by functionality. Please see the [Configuration](/getting-started/configuration.md) area for the new approach.

### Added

* New ability for the firewall to log all action events to a database table.
* If enabled, a new visualizer can visualize all settings and firewall events via the log table.
* New Basic Auth validator and basic auth user credentials storage system. This will allow you to secure apps where no database interaction is needed or required.
* New global and rule action: `block` and the firewall will block the request with a 401 Unauthorized page.
* New event `cbSecurity_onFirewallBlock` announced whenever the firewall blocks a request into the system with a 403.
* `DBTokenStorage` now rotates using the async scheduler and not direct usage anymore.
* Ability to set the `cbcsrf` module settings into the `cbsecurity` settings as `csrf`.
* We now default the user service class and the auth token rotation events according to the user authentication service (cbauth, etc.); no need to duplicate work.
* New rule-based IP security. You can add a `allowedIPs` key into any rule and add which IP Addresses are allowed into the match. By default, it matches all IPs.
* New rule-based HTTP method security. You can add a `httpMethods` key into any rule and add which HTTP methods are allowed into the match. By default, it matches all HTTP Verbs.
* New `securityHeaders` configuration to allow a developer to protect their apps from common exploits: XSS, HSTS, Content Type Options, host header validation, IP validation, clickjacking, non-SSL redirection, and much more.
* The security firewall now stores the authenticated user according to the `prcUserVariable` on authenticated calls via `preProcess()` no matter the validator used
* Dynamic Custom Claims: You can pass a function/closure as the value for a custom claim, and it will be evaluated at runtime, passing in the current claims before being encoded
* Allow passing in custom refresh token claims to `attempt()` and `fromUser()` and `refreshToken()` : `refreshCustomClaims`
* Added `TokenInvalidException` and `TokenExpiredException` to the `refreshToken` endpoint

### Fixed

* Disable lastAccessTimeouts for JWT CacheTokenStorage BOX-128
* Fix spelling of property `datasource` on `queryExecute` that was causing a read issue.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://coldbox-security.ortusbooks.com/readme/release-history/whats-new-with-3.0.0.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.