Connect anything,
anywhere.

1on_http_request:⋯2  # say bye to anonymous proxies3  - expressions:⋯4      - "'proxy.anonymous' in conn.client_ip.categories"5    actions:⋯6      - type: deny7 8  # rate limit requests by IP, unless you're a search/AI bot crawling the docs9  - expressions:⋯10      - "!('com.openai.gptbot.ipv4' in conn.client_ip.categories || 'com.google.googlebot.ipv4' in conn.client_ip.categories)"11      - "!req.url.path.startsWith('/docs')"12    actions:⋯13      - type: rate-limit⋯14        config:⋯15          algorithm: sliding_window16          bucket_key:⋯17            - conn.client_ip18          capacity: 1234519          enforce: false20          name: Limit 12345 requests per minute per ip and user agent21          rate: 60s22 23  # rate limit violators get their connection closed instead of 429 errors24  - expressions:⋯25      - actions.ngrok.rate_limit.limited26    actions:⋯27      - type: close-connection28 29  # this is our WAF, dawg30  - actions:⋯31      - type: owasp-crs-request⋯32        config:⋯33          exclude_rule_ids:⋯34            - 93226035          on_error: continue36          process_body: true37 38  # log all WAF decisions in our observability platform and then deny anomalous requests39  - expressions:⋯40      - actions.ngrok.owasp_crs_request.decision == 'deny'41    actions:⋯42      - type: log⋯43        config:⋯44          metadata:⋯45            action: waf deny46            anomaly_score: ${actions.ngrok.owasp_crs_request.anomaly_score}47            first_matched_data: ${actions.ngrok.owasp_crs_request.matched_rules[0].data}48            first_matched_id: ${actions.ngrok.owasp_crs_request.matched_rules[0].id}49            first_matched_message: ${actions.ngrok.owasp_crs_request.matched_rules[0].message}50            first_matched_severity: ${actions.ngrok.owasp_crs_request.matched_rules[0].severity}51            ngrok_error_message: ${actions.ngrok.owasp_crs_request.error.message}52            phase: request53      - type: deny54 55  # block countries to comply with legal requirements56  - expressions:⋯57      - conn.geo.country_code in ['ABC', 'DEF', 'XYZ']58    actions:⋯59      - type: deny60 61  # "we're hiring" easter egg for the curious developer62  - actions:⋯63      - type: add-headers⋯64        config:⋯65          headers:⋯66            x-ngrok-we-are-hiring: https://ngrok.com/careers67 68  # add a custom security.txt file without storing it in s3 or something69  - expressions:⋯70      - req.url.uri.contains('/.well-known/security.txt')71    actions:⋯72      - type: custom-response⋯73        config:⋯74          content: |+⋯75            Contact: mailto:security@ngrok.com76            Canonical: https://ngrok.com/.well-known/security.txt77            Policy: https://ngrok.com/security/disclosure-and-reward-program78            Hiring: https://ngrok.com/careers79            Preferred-Languages: en80            Expires: 2026-11-01T00:00:00Z81          headers:⋯82            Content-Type: text/plain; charset=utf-883          status_code: 20084 85  # redirect legacy /downloads path to /download86  - actions:⋯87      - type: redirect⋯88        config:⋯89          from: https://ngrok.com/downloads(/|$)(.*)90          status_code: 30191          to: https://ngrok.com/download/$292 93  # redirect legacy blog path+slug94  - expressions:⋯95      - req.url.path.startsWith('/blog-post')96    actions:⋯97      - type: redirect⋯98        config:⋯99          from: ^(https?://[^/]+)/blog-post/(.*)$100          status_code: 301101          to: $1/blog/$2102 103  # handle /docs by forwarding traffic to our docs hosted in s3104  - expressions:⋯105      - req.url.path.startsWith('/docs')106    actions:⋯107      - type: forward-external⋯108        config:⋯109          url: https://ngrok.docs-provider.com110 111  # handle /blog and asset paths by forwarding traffic to an external provider112  # sorry, we gotta be a little cheeky with these113  - expressions:⋯114      - '["/__blog-manifest","/blog-assets","/blog"].exists(p,req.url.path.startsWith(p))'115    actions:⋯116      - type: forward-external⋯117        config:⋯118          url: https://blog.deployment-provider.com119 120  # handle /, /download, /pricing/, and other paths by forwarding to the same provider, different deployment121  - expressions:⋯122      - '["/__manifest","/assets","/download","/pricing","/schemas"].exists(p,req.url.path.startsWith(p))'123    actions:⋯124      - type: forward-external⋯125        config:⋯126          url: https://frontend.deployment-provider.com127 128  # legacy website paths forward to cms129  - actions:⋯130      - type: url-rewrite⋯131        config:⋯132          from: /(.+)/$133          to: /$1134      - type: forward-external⋯135        config:⋯136          url: https://ngrok.cms-provider.com137 138on_http_response:⋯139  # run waf on all responses140  - actions:⋯141      - type: owasp-crs-response⋯142        config:⋯143          on_error: continue144          process_body: true145 146  # as before, log all those WAF decisions and deny responses147  - expressions:⋯148      - actions.ngrok.owasp_crs_response.decision == 'deny'149    actions:⋯150      - type: log⋯151        config:⋯152          metadata:⋯153            action: waf deny154            anomaly_score: ${actions.ngrok.owasp_crs_response.anomaly_score}155            first_matched_data: ${actions.ngrok.owasp_crs_response.matched_rules[0].data}156            first_matched_id: ${actions.ngrok.owasp_crs_response.matched_rules[0].id}157            first_matched_message: ${actions.ngrok.owasp_crs_response.matched_rules[0].message}158            first_matched_severity: ${actions.ngrok.owasp_crs_response.matched_rules[0].severity}159            ngrok_error_message: ${actions.ngrok.owasp_crs_response.error.message}160            phase: response161      - type: custom-response⋯162        config:⋯163          content: 403 Forbidden164          headers:⋯165            Content-Type: text/plain; charset=utf-8166          status_code: 403