What's a proxy?
A proxy sits in between you and a domain. Instead of traffic directly flowing between you and the server, it is routed through a proxy. This can be used for many things, but the most common use case you may have heard of is for bypassing website blocks.
Proxies can be divided into forward and reverse proxies. Let's take a look at two real-life scenarios first.
Scenario 1: Telegram has been blocked in China since 2015. Luckily, the Telegram app lets users configure a proxy to bypass this block. The proxy used here is a forward proxy.
Scenario 2: Supabase was blocked for a brief period in 2026 in India. An alternative endpoint called Jiobase allowed users to bypass this block by acting as a proxy. The proxy used here was a reverse proxy.
So what's the difference if they're both used for the same purpose?
The difference
Scenario 1:
When a client sends a request to a forward proxy, it also tells the proxy where it wants the request to go. In this case, the client knows it wants to connect to Telegram's servers. This is because the same proxy can be used for different services, not just for Telegram. This is why the destination needs to be specified.
Scenario 2:
When a client sends a request to a reverse proxy, it does not mention the destination like above. The proxy here routes data only to Supabase. The client, in fact, doesn't know which server the proxy connects to. This is another use case for a reverse proxy, to hide the backend from clients.
Note: One of the types of proxies you can use with Telegram is an MTProto proxy, which only communicates with Telegram servers. Still, this is a forward proxy because the client still needs to specify that it wants to connect to Telegram.
When most articles say "a forward proxy acts on behalf of a client" or "a reverse proxy sits in front of the server", this is what they mean in simple terms.
Other factors such as which side is facing the issue, who configures the proxy, how many domains it connects to, and so on may help distinguish them in some cases, but not always.
More examples
Scenario 3:
If you call the Reddit API directly within your frontend to fetch posts, you will run into a Cross-Origin Resource Sharing (CORS) error. This is because Reddit's backend doesn't send CORS headers to indicate that the frontend is allowed to read the response. Hence, your browser blocks the response, not Reddit.
We need to build our own backend that acts as a reverse proxy to allow our frontend to communicate with Reddit's servers. Our backend isn't subject to CORS restrictions, as CORS is a browser security mechanism. Since our backend can be configured to allow communication with our frontend, the issue is resolved.
Scenario 4:
The Opera GX browser comes with a built-in forward proxy (which they confusingly call a VPN) which sends all traffic from the browser through their proxy. This accomplishes the same result as an actual VPN, which is to hide the client's IP, but there are differences between the two.
A proxy only routes traffic from the configured application, wheres a VPN usually routes all internet traffic from the device. The protocols used by a proxy (HTTP, SOCKS5) and a VPN (WireGuard, OpenVPN) are also different.
In short, if the client specifies the destination on the other end of the proxy, it's a forward proxy. If the proxy decides the destination, it's a reverse proxy.
Top comments (0)