Redirect

Overview

The Redirect policy action enables transforming your URL using regular expressions and redirect through location header.

Example

Use this action config in your Traffic Policy

YAML
JSON

# snippet
---
actions:
  - type: "redirect"
    config:
      from: "v0/user/([0-9]+).*"
      to: "v1/user?id=$1&$args"
      status_code: 301
      headers:
        rewrite: "true"

// snippet
{
  "actions": [
    {
      "type": "redirect",
      "config": {
        "from": "v0/user/([0-9]+).*",
        "to": "v1/user?id=$1&$args",
        "status_code": 301,
        "headers": {
          "rewrite": "true"
        }
      }
    }
  ]
}

Behavior

When executed this action will abort the request and replace all matches on the inbound URL with the configured replacements. Before regular expression replacement occurs, all named variables will be replaced with their corresponding values.

Reference

Supported Directions

Inbound

Configuration

Type
`redirect`

Parameter		Description
`from`	string	A regular expression string to match inside of the URL.
`to`	string	A regular expression string to replace the `from` match with. Also contains special named variables outside of regular regex.
`status_code`	int	3xx status code used for redirecting, 302 by default.
`headers`	Map<string, string>	Headers to be added to the request.

Named Variables

Keyword	Description
`$args`	Replaces `$args` with a list of "&" delimited query parameters: "args1=value1&arg2=value2&...&argn=valuen"
`$authority`	Replaces `$authority` with the hostpost of the request url.
`$query_string`	Replaces `$query_string` with a list of "&" delimited query parameters: "args1=value1&arg2=value2&...&argn=valuen"
`$is_args`	Replaces `$is_args` with "?" if args are present, "" if not.
`$uri`	Replaces `$uri` with the request URI: path?query.
`$arg_<name>`	Replaces `$arg_name` with the value of query parameter `name` if it exists in the request, "" if not. `name` must only be comprised of digits, letters, and the "_" character. If there is more than one value assigned to `name`, only the first value will be substituted.
`$scheme`	Replaces `$scheme` with the scheme of the request, either `http` or `https`.
`$host`	Replaces `$host` with the host of the request url.
`$port`	Replaces `$port` with the port of the request url.
`$user`	Replaces `$user` with the user information of the request.
`$is_user`	Replaces `$is_user` with an "@" when user is not empty.

Variable Interpolation

You may interpolate variables into header values. Variables are interpolated into headers with JSONPath expressions surrounded by ${} syntax.

For example, to include geographical data about the client IP that initiated the request, you may construct a header value like so.

YAML
JSON

# snippet
---
actions:
  - type:
      type: "redirect"
    config:
      headers:
        country: "${conn.geo.country_code}"

// snippet
{
  "actions": [
    {
      "type": {
        "type": "redirect"
      },
      "config": {
        "headers": {
          "country": "${conn.geo.country_code}"
        }
      }
    }
  ]
}

Consult the Variables Reference for the available variables.

Variables

ngrok makes variables available for interpolation into headers.

Some variables will only be populated with values if you have configured the corresponding module for your endpoint, otherwise they will be empty. For example, the variable ${.basic_auth.username} is only available if you have enabled the basic auth module on your endpoint.

Backend Variables


`${.backend.connection_reused}`	True if ngrok reused a TCP connection to transmit the HTTP request to the upstream service.
`${.backend.dial_duration}`	The time to establish a connection from ngrok to the agent.
`${.backend.id}`	This is the ngrok ID of the backend that serviced this request. This is empty if the endpoint is not handled by an Edge.

Basic Auth Variables

These variables are only populated when using the Basic Auth module.


`${.basic_auth.decision}`	`allow` if the request successfully authenticated via the Basic Auth module, `block` otherwise.
`${.basic_auth.username}`	If the request successfully authenticated via the Basic Auth module, this is the username that authenticated.

Circuit Breaker Variables

These variables are only available when using the Circuit Breaker module.


`${.circuit_breaker.decision}`	Whether the HTTP request was sent to the upstream service. `allow` if the breaker was closed, `block` if the breaker was open, `allow_while_open` if the request was allowed while the breaker is open.

Compression Variables

These variables are only populated when using the Compression module.


`${.compression.algorithm}`	The compression algorithm used to encode responses from the endpoint. Either `gzip`, `deflate`, or `none`.
`${.compression.bytes_saved}`	The difference between the size of the raw response and the size of the response as compressed by ngrok.

Connection Variables


`${conn.bytes_in}`	The number of bytes entering the endpoint from the client.
`${conn.bytes_out}`	The number of bytes leaving an endpoint to the client.
`${conn.client_ip}`	Source IP of the connection to the ngrok endpoint.
`${conn.end_ts}`	Timestamp when the connection to ngrok was closed.
`${conn.server_ip}`	The IP that this connection was established on.
`${conn.server_port}`	The port that this connection was established on.
`${conn.start_ts}`	Timestamp when the connection to ngrok was started.

Geo IP Variables

The source of this data is subject to change. It is currently provided by MaxMind GeoIP.


`${conn.geo.city}`	The name of the city, in EN, where the `conn.client_ip` is likely to originate.
`${conn.geo.country}`	The name of the country, in EN, where the `conn.client_ip` is likely to originate.
`${conn.geo.country_code}`	The two-letter ISO country code where the `conn.client_ip` is likely to originate.
`${conn.geo.latitude}`	The approximate latitude where the `conn.client_ip` is likely to originate.
`${conn.geo.longitude}`	The approximate longitude where the `conn.client_ip` is likely to originate.
`${conn.geo.radius}`	The radius in kilometers around the latitude and longitude where the `conn.client_ip` is likely to originate.
`${conn.geo.subdivision}`	The name of the subdivision, in EN, where the `conn.client_ip` is likely to originate.

HTTP Request and Response Variables


`${req.content_length}`	The content length of the body in bytes. This may not be present if the request does not contain a body or if the client does not specify a content length because they are streaming the body.
`${req.content_type}`	The media type set in the Content-Type header for this request as a string.
`${req.content_type.parameters}`	The parameters set in the Content-Type header as a key value map.
`${req.content_type.raw}`	The Content-Type header for this request as a string.
`${req.cookies}`	The key value map of HTTP cookie objects provided in the request.
`${req.headers}`	The request headers parsed as a map of lower-case names to values.
`${req.host}`	The host header field value for this request.
`${req.location}`	The location header value of the request.
`${req.method}`	The request method.
`${req.trailers}`	The request trailers parsed as a map of lower-case names to values.
`${req.url}`	The normalized full URL for this request.
`${req.url.authority}`	The authority portion of the URL.
`${req.url.host}`	The host for this request.
`${req.url.path}`	The path for this request including the leading forward slash.
`${req.url.query}`	The full query string for this request excluding the leading question mark.
`${req.url.query_params}`	The request query string parsed as a map of names to values.
`${req.url.raw_path}`	The un-normalized path including the leading slash for this request.
`${req.url.scheme}`	The scheme for this request.
`${req.url.uri}`	The URI (path and query) portion of the URL.
`${req.url.user}`	The user:password portion of the URL.
`${req.user_agent}`	The user-agent header value for this request.
`${req.version}`	The HTTP version for this request.
`${res.content_length}`	The length of the content associated with the response.
`${res.content_type}`	The media type set in the Content-Type header for this response as a string.
`${res.content_type.parameters}`	The parameters set in the Content-Type header for this response as a key value map.
`${res.content_type.raw}`	The Content-Type header for this response as a string.
`${res.cookies}`	The key value map of HTTP cookie objects provided in the response.
`${res.headers}`	The response headers parsed as a map of lower-case names to values.
`${res.location}`	The location header value of this response.
`${res.status_code}`	The status code of this response.
`${res.trailers}`	The response trailers parsed as a map of lower-case names to values.

IP Restrictions Variables

These variables are only populated when using the IP Restrictions module.


`${.ip_policy.decision}`	`allow` if IP Policy module permitted the request to the upstream service, `block` otherwise.
`${.ip_policy.matching_rule}`	The rule that triggered an IP Policy match on the endpoint.

Mutual TLS

These variables are only populated when using the Mutual TLS module.


`${conn.tls.client.extensions}`	Additional information added to the certificate.
`${conn.tls.client.issuer}`	The issuing authority of the certificate as a string roughly following the RFC 2253 Distinguished Names syntax.
`${conn.tls.client.issuer.common_name}`	Common name of the issuing authority, usually the domain name.
`${conn.tls.client.issuer.country}`	Country name(s) where the issuing authority is located.
`${conn.tls.client.issuer.locality}`	Locality or city of the issuing authority.
`${conn.tls.client.issuer.organization}`	Name(s) of the organization that issued the certificate.
`${conn.tls.client.issuer.organizational_unit}`	Division of the organization responsible for the certificate.
`${conn.tls.client.issuer.postal_code}`	Postal code of the issuing authority.
`${conn.tls.client.issuer.province}`	Province or state of the issuing authority.
`${conn.tls.client.issuer.street_address}`	Street address of the issuing authority.
`${conn.tls.client.san}`	Subject alternative names of the client certificate.
`${conn.tls.client.san.dns_names}`	DNS names in the subject alternative names.
`${conn.tls.client.san.email_addresses}`	Email addresses in the subject alternative names.
`${conn.tls.client.san.ip_addresses}`	IP addresses in the subject alternative names.
`${conn.tls.client.san.uris}`	URIs in the subject alternative names.
`${conn.tls.client.serial_number}`	Unique identifier for the certificate.
`${conn.tls.client.signature_algorithm}`	Algorithm used to sign the certificate.
`${conn.tls.client.subject}`	The entity to whom the certificate is issued as a string roughly following the RFC 2253 Distinguished Names syntax.
`${conn.tls.client.subject.common_name}`	Common name of the subject, usually the domain name.
`${conn.tls.client.subject.country}`	Country name(s) where the subject of the certificate is located.
`${conn.tls.client.subject.locality}`	Locality or city where the subject is located.
`${conn.tls.client.subject.organization}`	Name(s) of the organization to which the subject belongs.
`${conn.tls.client.subject.organizational_unit}`	Division of the organization to which the subject belongs.
`${conn.tls.client.subject.postal_code}`	Postal code where the subject is located.
`${conn.tls.client.subject.province}`	Province or state where the subject is located.
`${conn.tls.client.subject.street_address}`	Street address where the subject is located.
`${conn.tls.client.validity.not_after}`	Expiration date and time when the certificate is no longer valid.
`${conn.tls.client.validity.not_before}`	Start date and time when the certificate becomes valid.

ngrok Variables


`${.ngrok.client_ip}`	This is the original client IP of the request.
`${.ngrok.request_id}`	This is the unique request ID generated by ngrok

OAuth Variables

These variables are only populated when using the OAuth module.


`${.oauth.app_client_id}`	The is the ID of the OAuth2 application used to handle this request.
`${.oauth.decision}`	'allow' if the OAuth module permitted the request to the upstream service, 'block' otherwise.
`${.oauth.user.email}`	This is the email address of the user that was authenticated.
`${.oauth.user.id}`	The authenticated user's ID returned by the OAuth provider.
`${.oauth.user.name}`	The authenticated user's name returned by the OAuth provider.

OpenID Connect Variables

These variables are only populated when using the OpenID Connect module. These variables are identical to the OAuth Variables.


`${.oauth.app_client_id}`	The is the ID of the OAuth application used to handle this request.
`${.oauth.decision}`	`allow` if the OpenID Connect module permitted the request to the upstream service, `block` otherwise.
`${.oauth.user.email}`	This is the email address of the user that was authenticated.
`${.oauth.user.id}`	The authenticated user's ID returned by the OpenID Connect provider.
`${.oauth.user.name}`	The authenticated user's name returned by the OpenID Connect provider.

SAML Variables

These variables are only populated when using the SAML module.


`${.ngrok.saml.subject}`	The SAML subject of the the authenticated user.

TLS Termination Variables

These variables are only populated on requests to HTTPS endpoints.


`${conn.tls.cipher_suite}`	The cipher suite selected during the TLS handshake.
`${conn.tls.server.extensions}`	Additional information added to the certificate.
`${conn.tls.server.issuer}`	The issuing authority of the certificate as a string roughly following the RFC 2253 Distinguished Names syntax.
`${conn.tls.server.issuer.common_name}`	Common name of the issuing authority, usually the domain name.
`${conn.tls.server.issuer.country}`	Country name(s) where the issuing authority is located.
`${conn.tls.server.issuer.locality}`	Locality or city of the issuing authority.
`${conn.tls.server.issuer.organization}`	Name(s) of the organization that issued the certificate.
`${conn.tls.server.issuer.organizational_unit}`	Division of the organization responsible for the certificate.
`${conn.tls.server.issuer.postal_code`	Postal code of the issuing authority.
`${conn.tls.server.issuer.province`	Province or state of the issuing authority.
`${conn.tls.server.issuer.street_address`	Street address of the issuing authority.
`${conn.tls.server.san}`	Subject alternative names of the ngrok server's leaf TLS certificate.
`${conn.tls.server.san.dns_names}`	DNS names in the subject alternative names of the ngrok server's leaf TLS certificate.
`${conn.tls.server.san.email_addresses}`	Email addresses in the subject alternative names of the ngrok server's leaf TLS certificate.
`${conn.tls.server.san.ip_addresses}`	IP addresses in the subject alternative names of the ngrok server's leaf TLS certificate.
`${conn.tls.server.san.uris}`	URIs in the subject alternative names of the ngrok server's leaf TLS certificate.
`${conn.tls.server.serial_number}`	Unique identifier for the certificate.
`${conn.tls.server.signature_algorithm}`	Algorithm used to sign the certificate.
`${conn.tls.server.subject}`	The entity to whom the certificate is issued as a string roughly following the RFC 2253 Distinguished Names syntax.
`${conn.tls.server.subject.common_name}`	Common name of the subject, usually the domain name.
`${conn.tls.server.subject.country}`	Country name(s) where the subject of the certificate is located.
`${conn.tls.server.subject.locality}`	Locality or city where the subject is located.
`${conn.tls.server.subject.organization}`	Name(s) of the organization to which the subject belongs.
`${conn.tls.server.subject.organizational_unit}`	Division of the organization to which the subject belongs.
`${conn.tls.server.subject.postal_code}`	Postal code where the subject is located.
`${conn.tls.server.subject.province}`	Province or state where the subject is located.
`${conn.tls.server.subject.street_address}`	Street address where the subject is located.
`${conn.tls.server.validity.not_after}`	Expiration date and time when the certificate is no longer valid.
`${conn.tls.server.validity.not_before}`	Start date and time when the certificate becomes valid.
`${conn.tls.sni}`	The hostname included in the ClientHello message via the SNI extension.
`${conn.tls.version}`	The version of the TLS protocol used between the client and the ngrok edge.

Webhook Verification Variables

These variables are only populated when using the Webhook Verification module.


`${.webhook_validation.decision}`	'allow' if the Webhook Verification module permitted the request to the upstream service, 'block' otherwise.

Redirect

Overview​

Example​

Behavior​

Reference​

Supported Directions​

Configuration​

Named Variables​

Variable Interpolation

Variables​

Backend Variables​

Basic Auth Variables​

Circuit Breaker Variables​

Compression Variables​

Connection Variables​

Geo IP Variables​

HTTP Request and Response Variables​

IP Restrictions Variables​

Mutual TLS​

ngrok Variables​

OAuth Variables​

OpenID Connect Variables​

SAML Variables​

TLS Termination Variables​

Webhook Verification Variables​