June 2022 Summaries

Ngrok has released a Defense in Depth white paper as part of its commitment to enhancing security for customers, detailing how its comprehensive security controls, including routing, encryption, network restrictions, SSO, and monitoring, work to protect data confidentiality, integrity, and availability. This white paper aims to help users understand the security trade-offs and choose the appropriate controls for securing their systems without disrupting business operations. It is part of ngrok's broader investment in security, along with their SOC 2 report, trust portal, and new product features, to maintain trust and reliability for developers and businesses using their service.

Ngrok is a tool that enables developers to securely connect applications to the internet, but it has also been exploited for spamming, spoofing, and phishing attacks. To combat this, ngrok has implemented a new measure where new, free users serving content through a web browser will encounter an interstitial page, prompting them to acknowledge that the site is served by ngrok. This step, aimed at curbing phishing activities, is required only once per browser session and does not affect users serving APIs or programmatically accessing ngrok endpoints. Ngrok's strategy to mitigate malicious activities involves a combination of automatic detection, human moderation, and external reporting, with further information and reporting instructions available on their abuse page.

Ngrok's Traffic Policy system allows users to add authentication to application endpoints quickly and without modifying application code, using a configuration language in YAML to manage traffic through various rules. These rules filter, validate, and route requests before they reach the upstream service, enabling the implementation of different authentication methods such as Basic Auth, OAuth, OpenID Connect, and JWT validation. Basic Auth is suitable for quick demos or internal tools, while OAuth and OpenID Connect cater to consumer-facing and enterprise applications, respectively. JWT validation is aimed at API-to-API authentication. Users can layer multiple authentication methods and combine them with other actions like rate limiting or IP restrictions, with all authentication occurring in ngrok's cloud to ensure invalid requests do not impact user infrastructure. The Traffic Inspector in the ngrok dashboard assists in debugging authentication failures by providing detailed request information.