What Is a Proxy?
Imagine you want to order something from a café, but instead of speaking directly to the café, you ask another person to place the order on your behalf. That person acts as an intermediary.
In software, a proxy server acts as an intermediary between a client and another server. It receives requests and forwards them to the destination.
Proxies can help with security, privacy, traffic management, caching, access control, and hiding internal server details.
Forward Proxy
Imagine you work in an office that has a receptionist. Whenever you want to visit a website, you ask the receptionist to access it on your behalf. The website receives the request from the proxy rather than directly from your computer.
A forward proxy represents the client when communicating with destination servers.
How Does a Forward Proxy Work?
- The client sends a request to the forward proxy.
- The proxy forwards the request to the destination server.
- The destination server responds to the proxy.
- The proxy returns the response to the client.
Why Use a Forward Proxy?
- Hide the client's IP address from destination servers.
- Block access to restricted websites.
- Monitor and control employee internet usage.
- Cache frequently accessed content.
- Apply organization-wide internet access policies.
Real-World Examples
Corporate network proxies, privacy proxies, and web filtering systems.
Reverse Proxy
Imagine a café with multiple chefs. Customers do not know which chef will prepare their order. They simply give their order to the manager at the counter. The manager decides which chef should handle it.
A reverse proxy represents one or more backend servers to clients and acts as the entry point for incoming requests.
How Does a Reverse Proxy Work?
- The client sends a request to the reverse proxy.
- The reverse proxy receives the request.
- It selects an appropriate backend server.
- The backend server processes the request.
- The reverse proxy returns the response to the client.
Why Use a Reverse Proxy?
- Distribute traffic across multiple backend servers.
- Hide backend server details and addresses.
- Terminate HTTPS/TLS connections.
- Cache frequently requested responses.
- Apply authentication and access-control rules.
- Route requests to different services.
- Help protect backend infrastructure.
Real-World Examples
Nginx, HAProxy, and cloud-based application load balancers can operate as reverse proxies.
Forward Proxy vs. Reverse Proxy
| Feature | Forward Proxy | Reverse Proxy |
|---|---|---|
| Represents | Client | Backend server |
| Sits in front of | Clients | Backend servers |
| Main purpose | Control or mediate client access | Manage incoming server traffic |
| Hides | Client identity or IP from destination servers | Backend server details from clients |
| Common users | Organizations and individual users | Websites and application operators |
| Example | Office internet proxy | Nginx reverse proxy |
Easy way to remember:
- Forward proxy = acts on behalf of the client.
- Reverse proxy = acts on behalf of the server.
How Does a Reverse Proxy Help in System Design?
Imagine your application becomes popular and receives 10,000 requests per second. One server may not be able to handle all the traffic, so you add multiple backend servers and place a reverse proxy in front of them.
The reverse proxy can:
- Distribute traffic between backend servers.
- Send requests only to healthy servers when health checks are configured.
- Cache frequently requested responses.
- Handle HTTPS connections.
- Route
/api/usersto one service and/api/ordersto another.
A reverse proxy provides a single public entry point while backend servers can remain on private networks.
Proxy vs. Load Balancer
These terms are related, but they are not identical.
| Proxy | Load Balancer |
|---|---|
| Acts as an intermediary between clients and servers | Distributes incoming workload across multiple servers |
| Can provide security, caching, and routing | Primarily focuses on distributing traffic and availability |
| Can work with one or multiple backend servers | Typically distributes work across multiple backend servers |
A reverse proxy can also function as a load balancer. For example, Nginx can perform both roles.
Common Reverse Proxy Features
1. Load Balancing
A reverse proxy can distribute requests across multiple backend servers using strategies such as round robin, least connections, or weighted routing.
2. TLS Termination
The reverse proxy can handle the HTTPS/TLS connection from the client and forward requests to backend servers over a protected internal connection where required by the security design.
3. Caching
It can store eligible responses and serve them to later requests, reducing work for backend servers. Cache rules must account for user-specific or sensitive content.
4. Routing
It can route requests based on hostnames, URL paths, or other request properties. For example, /users may go to the user service and /orders to the order service.
5. Security and Access Control
It can enforce access rules, filter requests, and help shield backend infrastructure. It is not a replacement for application-level authorization.
Popular Proxy Technologies
Nginx
Nginx is commonly used as a web server, reverse proxy, caching layer, and load balancer.
HAProxy
HAProxy is widely used for high-performance proxying and load balancing.
Squid
Squid is commonly used for forward proxying and web caching.
Quick Interview Question
Question: Your application has five backend servers. You want to hide their addresses, distribute traffic, and terminate HTTPS connections. What would you use?
Sample answer:
“I would use a reverse proxy such as Nginx or HAProxy as the public entry point. It can terminate TLS, route requests, and distribute traffic across backend servers. I would also configure health checks, timeouts, and monitoring so unhealthy servers are not selected.”
Follow-Up: Is a Reverse Proxy the Same as an API Gateway?
No. An API gateway is a specialized entry point for APIs and often includes features such as authentication, authorization, rate limiting, request transformation, and API-specific routing. It may use reverse-proxy functionality internally, but a basic reverse proxy does not automatically provide all API gateway capabilities.
Follow-Up: Does a Reverse Proxy Always Improve Security?
Not automatically. It can reduce direct exposure of backend servers and centralize controls, but incorrect configuration can introduce vulnerabilities. Backend services still need authentication, authorization, secure communication, and proper network controls.
Key Takeaway
- Proxy: An intermediary between a client and a server.
- Forward proxy: Acts on behalf of clients.
- Reverse proxy: Acts on behalf of backend servers.
- Reverse proxy with load balancing: Helps distribute incoming traffic and improve scalability and availability.
Remember: A forward proxy faces the client; a reverse proxy faces the server.
Top comments (1)
The cafe analogy works because it separates the person asking from the service that actually fulfills the request. A helpful next step for beginners is to show that a proxy can add behavior at the boundary: authentication, caching, logging, or routing. That explains why it is more than just another URL between a browser and a server.