Ngrok: Feature request: custom X- headers (X-Forwarded-Proto for one)

[fairbairn]

Sure would be nice to support propagation of custom X headers through ngrok.

We use it for HTTPS routing to our localhost:port web site during development, but we need to properly detect the scheme being used from the outside.

ngrok doesn't appear to populate the X-Forwarded-Proto value, so when we use HTTPS, we have no idea if we're running HTTPS or HTTP, which makes some internal logic for redirection impossible.

In short, we'd have to set up yet another proxy like Nginx between ngrok and our app, which is a bit of a pain.

Would be great if there was some kind of configuration option in which ngrok could be instructed populate that X-Forwarded-Proto value properly (among others), so our back-end servers could handle it as if we were proxied behind Nginx.

How could this be done?

[inconshreveable]

Not sure what version you're talking about, but ngrok 2.X populates X-Forwarded-For and X-Forwarded-Proto as well as passing any other X headers through transparently:

curl -H "X-Foo: Bar" https://77b18c57.ngrok.io

[nickbaum]

Hi Alan, can you confirm that this should work for custom domains as well?

I just upgraded to a Pro plan to use custom domains with TLS tunnels, but I'm not getting the X-Forwarded-Proto for https requests.

ngrok version 2.1.14

[inconshreveable]

X-Forwarded-Proto won't be in requests over TLS tunnels. TLS tunnels are end-to-end encrypted. the traffic through them can't be modified to add headers (or TLS would be broken)

[nickbaum]

Thanks for the prompt response. We're using the -crt and -key options to terminate the TLS connection. Would it make sense for the ngrok client to add the X-Forwarded-Proto header then?

[inconshreveable]

Yeah, I think it would. putting it on the backlog

[nickbaum]

Thanks!

Let me know if it'd be helpful to file a new issue to track the feature request.

Also, sorry for calling you Steve, just updated the comment above...

[inconshreveable]

To clarify: this requires a new concept to be introduced. ngrok is agnostic to the traffic coming through TLS tunnels (it doesn't know HTTP is underneath). some future version will need to define a way for you to tell ngrok what the expected underlying protocol is and then have special handling for http. this is a ways out because of that

[nickbaum]

Got it, thanks for the explanation.

[lastobelus]

I really need this as well.

I am developing an embedded shopify app with rails, and use ngrok to have https and real domains in development, required by shopify.

However, I want to use websockets, and http tunnel doesn't work for that because browsers reject the domain mismatch in the ngrok cert, and give no option for trusting the connection.

So, I want to use a TLS tunnel with letsencrypt certs and let ngrok terminate. However, without the X-Forwarded-Proto Rails breaks in many ways, because it thinks requests are https. Some can be worked around but the CSRF protection not so easily.

[lastobelus]

for anyone else in a similar situation, I was able to make rails happy by just using a middleware that set rack.url_scheme:

class ForceUrlScheme
  def initialize(app)
    @app = app
  end

  def call(env)
    env['rack.url_scheme'] = 'https'
    @app.call(env)
  end
end

Since in my case I did not ever need to deal with urls that aren't https, this works fine.

[andrew-stripe]

I also just ran into this and would value a separate HTTPS mode with -crt/-key in which ngrok injects the right header.

[jonathanhle]

+1

[kastork]

+1 You really can't use ngrok to test apps that will reside behind a load balancer that does the TLS termination on behalf of the app unless this is implemented.

[RajuTanti]

i have an azure app service and facing somehow similar error with application gateway redirection, some how my application is dropping the ssl. can any one help me on this.