October 2023 Summaries

Ngrok has introduced a Pay-as-you-go pricing plan tailored for customers using its services to deliver apps and APIs in production environments, focusing on active endpoints where data is transmitted. This model allows users to only pay for what they use, aligning costs with actual consumption and providing flexibility without upfront commitments. It is particularly advantageous for businesses transitioning to production environments, enabling them to scale efficiently, connect to external networks securely, and support emerging use cases like IoT and enterprise applications. The plan is designed to accommodate the growing needs of businesses by allowing them to scale their billing as they expand their customer base or increase their use of ngrok's services. This approach offers freedom to experiment with new business models without long-term licensing constraints, making it an ideal fit for production environments. Ngrok has also released new features like Always-On GSLB and Kubernetes Ingress Controllers, further enhancing its offerings for production workloads.

This tutorial provides a comprehensive guide to building a CRUD (Create, Read, Update, Delete) application using Node.js, Express, React, and MongoDB. The application allows users to manage a collection of vinyl records, including adding new records, viewing existing records, editing existing records, and deleting records. The backend is built using the Express framework, with RESTful API endpoints for interacting with the database. The frontend is built using React, with client-side routing using React Router. The tutorial covers setting up the project, building the backend server, creating the API routes, adding MongoDB to store data, defining the VinylRecord model, and implementing CRUD operations. Additionally, it explains how to run the application locally and deploy it online using ngrok for testing and production purposes.

The Security and Identity (SI) team at ngrok recently introduced Multi-Factor Authentication (MFA) to enhance the security of ngrok accounts, particularly for production environments. By exploring the technical and security challenges, the team implemented MFA as an optional feature to add an additional layer of security beyond passwords, using Time-based One-Time Passwords (TOTPs). This involved developing a service to manage TOTP devices and leveraging existing internal libraries for secure storage. The introduction of MFA also required addressing the complexities of a multi-tenant infrastructure, where accounts can represent organizations rather than individual users. To mitigate potential user friction, MFA was made opt-in, and a support-based recovery method was chosen over SMS-based alternatives due to its stronger security posture against risks like SIM hijacking. The project highlights ngrok's commitment to safeguarding production infrastructure while balancing security with user experience.

To safeguard against the increasing prevalence of cyber threats, companies need to implement defensive security measures and assess their effectiveness in preventing unauthorized access to their networks. A key aspect of this strategy involves various types of authentication to verify both user and device access at the network edge. User authentication typically requires a username and password or federated authentication with an identity provider for single sign-on (SSO), while device authentication relies on runtime context and information. Basic HTTP authentication provides a simple but limited security method, whereas OAuth 2.0 and OpenID Connect (OIDC) offer more robust solutions by facilitating secure delegated access through tokens issued by identity providers, critical for API-driven ecosystems. Security Assertion Markup Language (SAML) is commonly used for single sign-on in enterprises, allowing users to access multiple applications with a single login. Mutual TLS (mTLS) establishes trust between entities by exchanging certificates, ensuring only recognized entities connect to services. Webhook verification and API authentication further enhance security by ensuring requests come from trusted sources and securely handling user credentials. All these authentication methods are crucially applied at the network edge to block unauthorized traffic and mitigate attacks before they reach the infrastructure, thereby maintaining secure operations without disrupting user workflows.

Global Server Load Balancing (GSLB) enhances application performance and resilience by directing client traffic to the nearest healthy point of presence, thereby minimizing latency and ensuring uninterrupted service even during failures. By fine-tuning DNS resolution, GSLB routes users to the closest server, significantly improving loading times and user experience. This system not only distributes network traffic across various global Points of Presence (PoPs) to prevent server overloads but also supports disaster recovery by redirecting traffic to backup sites during outages. ngrok enhances GSLB by offering a cloud-based, zero-configuration solution that combines GSLB with firewall and reverse proxy functionalities, ensuring secure and efficient traffic routing via its global network of PoPs. This setup simplifies IT operations by automatically routing traffic to new locations without manual configuration, providing resilient and high-performing connections for users worldwide.

The blog post discusses the development of a production-ready chat application using Go, with a focus on utilizing ngrok's Go SDK v2 to simplify the process. It outlines the complexity of building such applications, emphasizing the need for collaboration and a deep understanding of various technologies, which prompts many teams to adopt SaaS tools for infrastructure management. The series guides readers through creating a chat app with a basic web UI on a local machine, leveraging ngrok for testing and public deployment, and progressively adds features such as OAuth for authentication, Docker for containerization, and Kubernetes for orchestration. The backend is built using Go, while the frontend employs JavaScript and HTML, with real-time interaction facilitated by server-side functions and JSON for message persistence. Testing and deployment are streamlined using ngrok, which provides a public URL for the locally hosted app, allowing for easy sharing and access. Future installments promise enhancements like improved UI, security features, and user tracking, illustrating a comprehensive roadmap for taking the app from a local prototype to a robust, shareable application.

Webhooks are crucial for keeping applications informed about changes in other systems, allowing developers to respond to events like successful payments or opened pull requests. Ensuring the security of webhooks is essential, as it involves confirming the source and integrity of the messages received. Developers must utilize security measures such as HTTPS to prevent eavesdropping and man-in-the-middle attacks, while also leveraging the security features provided by webhook providers, even though not all providers enforce their use. It is advisable to restrict the IPs that can send webhook requests, securely store secrets, and perform callbacks to verify data changes. Tools like ngrok offer built-in webhook verification, simplifying the authentication process across leading providers. Following best practices in webhook security helps maintain the privacy, authenticity, and integrity of the messages, ensuring seamless integration between otherwise disconnected systems.