Ngrok doesn’t pass that header, depending if there is a proxy layer between the application or not Strapi sees the last IP “hop” that the request was coming from.
If Ngrok does support passing that header then you need to enable the setting that tells Strapi it’s behind a proxy (I don’t know if Ngrok does or not)
proxy: Set the koa variable
app.proxy. Whentrue, proxy header fields will be trusted.
IE: x-forwarded-for
More information about this header (I’m not going to dive into deep networking topics): X-Forwarded-For - HTTP | MDN