Explanation
Understand how traffic is kept safe
See how a request is checked and what keeps tunnel traffic apart from your account.
- Applies to
- All plans
- Time
- About 4 minutes to read
- What it changes
- None. This page explains; it changes nothing.
- Last reviewed
- , by Product documentation
Where a request is checked
A request arrives over HTTPS at InstaWormhole's edge. The edge applies the tunnel's rules in a fixed order: whether the address was disabled for violating the Acceptable Use Policy, the tunnel's request and transfer limits, its IP list, and its password or token. A request that fails a rule is answered by the edge and never reaches your computer.
A request that passes goes to the relay, which sends it to your connector over the connection your connector opened. The connector forwards it to the loopback address you gave it.
What keeps traffic apart
- Tunnel traffic is served only from instawormhole.site. Your account, sign-in and dashboard are on instawormhole.com, a different domain, so an app behind a tunnel cannot read your InstaWormhole cookies.
- The relay treats forwarded requests as untrusted input. Headers, redirects and payloads are checked at each step.
- The connector has narrow permissions. It does not have access to databases, billing, administration or signing keys.
- If the edge cannot read a tunnel's protection rule, it refuses requests to that tunnel instead of letting them through.
Limits of the protection
We do not claim certifications such as SOC 2.
Related
This page is part of Security, privacy and reliability. Still stuck? Contact support.