Loading

Introducing Web Metering 2.0

Re‑architected for Security, Enhanced Privacy, and Safari Support Is Back

 

We’re pleased to announce Web Metering 2.0, a significant enhancement to web application metering for FlexNet and Snow agents. This release introduces a newly re‑architected browser data ingestion pipeline, delivering stronger security, improved privacy protections, and expanded browser support—including the return of Apple Safari.

 

What’s New in Web Metering 2.0

Web Metering 2.0 has been redesigned from the ground up to provide a more secure and privacy‑focused experience while maintaining reliable usage insights.

Key benefits include:

  • 🔐 Enhanced Security
  • Improved protections across browser data collection and ingestion.
  • 🛡️ Reduced PII Collection
  • Optimized data handling to minimise the capture of Personally Identifiable Information (PII).
  • 🌍 Expanded Browser Support
  • Full support for Apple Safari, alongside Google Chrome, Microsoft Edge, and Mozilla Firefox.

 

What You Need to Know

To use Web Metering 2.0, customers must deploy both a new agent version and the new Web Metering browser extensions.

Required Agent Versions

  • FlexNet Agent: Available in v25.5.0 (scheduled for May release)
  • Snow Agent: Available in v26.1.1 (scheduled for June release)

Important:

Existing agent versions are only compatible with the current browser extensions.

The new extensions labelled “Flexera Web Metering” will work only with the agent versions listed above and later.

 

🌐 Current Browser Extension Downloads

Please continue using the following extensions until the new version of the agents are released.


mag00_75 likes this.
  • With the release will the changes/improvements be described more in detail?

    • Gabriel Carvalho (Flexera Software)

      I will follow up with a more detailed announcement later on.

  • Will installing the new Snow agent uninstall the old web extensions when it removes the old Snow agent?

    Likewise will this new metering system work with SLM v25+ and not just Snow Atlas, or will an INV/SLM update also be needed to make use of it.

    • Gabriel Carvalho (Flexera Software)

      If you have the agent handling the extension installation (<Setting key="saas.%BrowserName%.enabled" value="true" />), then yes.

      The old extension will be removed uninstallation and the new one will be installed by the new agent.

       

      If you have <Setting key="saas.%BrowserName%.enabled" value="enable" /> or <Setting key="saas.all_managed" value="enable" />, it means your organization is handling the extension deployment, so the agent will not remove it.

       

      Yes, it is supported by INV/SLM v25+

      Expand Post
    • Gabriel Carvalho (Flexera Software)

      Hi @bmaudlin​,

      I posted a new announcement with more details.

      The full documentation will be live later this week.

      Does that help you?

  • @Gabriel Carvalho (Flexera Software)​ , thanks for this. It looks like this is in a different category of comms to this thread, so it was difficult to track down. For people following this thread, this is available here > https://community.flexera.com/s/feed/0D5PL00000rqzsK0AQ

     

    I do have some follow up questions that I would be asking from an Infosec lens, that are not addressed in the further communications or documentation as I have seen, as below >

     

    • How does the agent know the request is coming from the Flexera browser extension and not another program? s there a secret token or key exchanged between the browser extension and the agent? How is that token generated, stored, and rotated?
    • Does the agent check who is sending the request?Does the agent validate the Origin header and reject requests that don't come from the official browser extension?
    • Is the endpoint guaranteed to only listen on the local machine?How is the agent configured to ensure it only listens on 127.0.0.1? Is this enforced in code or just a configuration setting that could be changed?
    • What happens if something else is already using port 40400 when the agent starts? How does the agent handle port conflicts on startup?
    • Does the endpoint send any data back to the browser extension? What does the HTTP response contain? Is it limited to a simple success or failure status code, with no additional data?
    • Are requests to the API logged? 
    • Is there a limit on how many requests can be sent to the endpoint? Without a limit, a bug in the browser extension….or a malicious program..could flood the agent with thousands of requests per second, potentially causing it to crash or consume excessive system resources
    Expand Post
    • Gabriel Carvalho (Flexera Software)

      Hi @bmaudlin​,

       

      Let me confirm the answers with my team and I'll get back to you.

      Unfortunately, the ones that worked on the feature are on leave this week, and we will need to wait for their return.

       

      Regards,

      Expand Post

Loading
Feed Detail