November 2022 Summaries

Ngrok has introduced a new feature called App Users, enhancing security and user session visibility for applications by providing detailed identity information including device, browser, and network context through its dashboard. This feature aligns with modern security frameworks like Zero Trust and BeyondCorp by ensuring continuous authentication and security throughout user interactions, from login to logout. It allows users to view, revoke, and block sessions in real-time, integrating seamlessly with ngrok's identity features and supporting OAuth, OIDC, and SAML without requiring changes to existing setups. The implementation of App Users is straightforward, involving the use of ngrok's dashboard or APIs to manage user sessions and provides immediate feedback through session management capabilities. As ngrok continues to expand its features and integrations, App Users is set to become an integral part of application security, reducing adoption barriers and enhancing the security posture of applications.

Webhooks serve as a vital mechanism for services and applications to communicate event notifications across different platforms, becoming a standard in SaaS environments. While offering flexibility and power, webhooks demand a live internet connection, presenting security challenges that can be exploited for malicious purposes without proper controls. A significant study by ngrok explored 100 webhook providers, integrating with over 50, revealing that Hash-based Message Authentication Code (HMAC) is the predominant method for webhook authentication, used by 65% of services. Despite its popularity, HMAC implementations often lack comprehensive security measures such as timestamp verification, versioning, and zero downtime secret rotation, with only a small fraction of providers incorporating these features. The study emphasizes the importance of robust documentation to aid developers in implementing secure webhook listeners, as poorly documented security steps can lead to incomplete implementations and increased vulnerability. Additionally, the research highlights the fragmented nature of webhook security practices, with varying levels of protection and complexity, urging both providers and consumers to adopt best practices for enhanced security and reliability.

Ngrok has announced the general availability of enterprise Single Sign-On (SSO) for its accounts, enhancing security and management by allowing customers to integrate their ngrok Dashboard with their Identity Provider (IdP) for centralized user account management and multi-factor authentication. Supporting any SAML 2.0-compliant IdP, including Okta and AzureAD, ngrok offers a self-service setup for Enterprise customers, with options for Mixed Mode and SSO Enforced mode logins. Users can directly access ngrok from their IdP application portal, streamlining access to all SSO applications. Future developments include SCIM v2 compatible APIs for automated user provisioning and deprovisioning, as well as features to consolidate individual accounts into a single corporate account by verifying email domains. Ngrok emphasizes the importance of user feedback to refine its SSO features and overall product offerings.

This month's updates highlight significant advancements in ngrok's productivity and security features, such as agentless tunnel launching and new OAuth providers, enabling seamless integration and IT approval within organizations. Ngrok has introduced SSH reverse tunneling for environments where the ngrok agent cannot run, alongside support for OAuth 2.0 providers like GitLab, LinkedIn, and Twitch for enhanced identity management. The latest version of the ngrok agent, v3.1.0, now includes signed Windows executables to ensure authenticity, and ngrok has expanded its partner program with over 30 integrations to streamline software development. Updates to webhooks.fyi include new assessments and best practices, while upcoming events like Longhorn PHP and Zoomtopia will focus on API security and Zoom app development. Additional product improvements feature the ngrok-go library for embedding connectivity in Go applications, a dynamic Kubernetes ingress controller, and updated webhook verifiers for various platforms.