Reverse Proxy Explained

A reverse proxy is a server that receives requests from clients and forwards them to one or more backend servers. Instead of connecting directly to an application server, the client communicates with the reverse proxy, which decides where the request should go and then returns the backend response to the client.

Reverse proxies are widely used in modern web applications because they provide a central point for routing, TLS termination, security controls, caching, compression and load balancing. They can sit in front of websites, APIs, application servers and entire groups of backend services.

What Is a Reverse Proxy?

A reverse proxy is an intermediary positioned between clients and backend servers. The client sends a request to the reverse proxy, and the proxy forwards that request to an appropriate backend service. The backend processes the request and sends its response back through the proxy.

Client
  ↓
Reverse Proxy
  ↓
Backend Server
  ↓
Reverse Proxy
  ↓
Client

Reverse Proxy vs Forward Proxy

The main difference between a forward proxy and a reverse proxy is which side of the connection the proxy represents. A forward proxy acts on behalf of clients, while a reverse proxy acts on behalf of servers.

How a Reverse Proxy Works

When a user visits a website behind a reverse proxy, the browser connects to the proxy instead of directly connecting to the application server. The proxy receives the HTTP request, evaluates its configuration and forwards the request to the selected backend.

• Client sends an HTTP request.
• Reverse proxy receives the request.
• Proxy selects a backend server.
• Backend processes the request.
• Backend sends a response to the proxy.
• Proxy returns the response to the client.

Basic Reverse Proxy Example

Nginx is commonly used as a reverse proxy in front of applications running on Node.js, Python, PHP or other application servers. A simple configuration can forward incoming requests from a public HTTP endpoint to an application listening on a local port.

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
    }
}

Why Use a Reverse Proxy?

A reverse proxy can provide several capabilities that would otherwise need to be implemented separately by application servers. It can centralize network configuration while allowing backend services to focus on application logic.

• Route requests to backend services.
• Balance traffic across multiple servers.
• Terminate TLS connections.
• Cache frequently requested responses.
• Hide backend server details.
• Apply security and access controls.
• Compress HTTP responses.
• Serve static content efficiently.

Request Routing

One reverse proxy can route different URL paths or hostnames to different backend applications. This allows several services to share the same public domain while remaining separate internally.

location / {
    proxy_pass http://frontend:3000;
}

location /api/ {
    proxy_pass http://api:4000;
}

location /admin/ {
    proxy_pass http://admin:5000;
}

Reverse Proxy and TLS

A reverse proxy can terminate TLS connections before forwarding requests to backend services. The public connection uses HTTPS, while the proxy can communicate with internal services using HTTP or HTTPS depending on the network and security requirements.

Client
  │
  │ HTTPS
  ↓
Reverse Proxy
  │
  │ HTTP or HTTPS
  ↓
Backend

Load Balancing

A reverse proxy can distribute incoming requests across multiple backend servers. This is known as load balancing and can improve availability, scalability and resource utilization.

upstream backend {
    server 10.0.0.10:3000;
    server 10.0.0.11:3000;
    server 10.0.0.12:3000;
}

server {
    listen 80;

    location / {
        proxy_pass http://backend;
    }
}

Health Checks and Availability

In production environments, reverse proxy infrastructure can be combined with health checks to prevent traffic from being sent to unhealthy backend servers. This allows applications to continue serving requests when individual instances fail.

Caching Through a Reverse Proxy

A reverse proxy can cache responses so that repeated requests do not always reach the backend application. This is particularly useful for static resources and other responses that can safely be reused for a period of time.

Cache-Control: public, max-age=3600

Caching behavior is controlled through HTTP headers and proxy configuration. The proxy must respect application requirements because caching a private or personalized response incorrectly can expose data to other users.

Forwarding HTTP Headers

Because the reverse proxy sits between the client and backend, the backend may otherwise see the proxy's address instead of the original client's address. Proxy headers can preserve information about the original request.

location / {
    proxy_pass http://127.0.0.1:3000;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

The X-Forwarded-For Header

The X-Forwarded-For header is commonly used to communicate the original client IP address through one or more proxies. When multiple proxies are involved, the header can contain a chain of addresses representing the request path.

Security Benefits

A reverse proxy can provide an additional security boundary between the public internet and backend services. Backend servers can remain on private networks and expose only the proxy to the public internet.

• Hide internal server addresses.
• Restrict publicly exposed ports.
• Apply request filtering.
• Terminate TLS centrally.
• Rate-limit incoming traffic.
• Restrict access to sensitive paths.

Reverse Proxy as an Access Gateway

A reverse proxy can act as a common entry point for multiple internal services. Authentication, IP restrictions, rate limiting and routing rules can be applied before requests reach individual applications.

Internet
   │
   ↓
Reverse Proxy
   ├── Web Application
   ├── REST API
   ├── Admin Panel
   └── Internal Service

Rate Limiting

Rate limiting at the reverse proxy layer can prevent clients from sending excessive numbers of requests to backend services. This can reduce accidental overload and provide an additional defense against certain forms of abuse.

Compression

Reverse proxies can compress HTTP responses before sending them to clients. Compression reduces bandwidth usage and can improve transfer times, particularly for text-based resources such as HTML, CSS, JavaScript and JSON.

gzip on;
gzip_types
    text/plain
    text/css
    application/json
    application/javascript;

Static Files and Dynamic Applications

A reverse proxy can serve static files directly while forwarding dynamic requests to an application server. This allows the application to concentrate on dynamic processing instead of handling every type of request.

Reverse Proxy in Microservices

In a microservices architecture, a reverse proxy can provide a single public entry point while routing requests to independent services. This simplifies the external API structure because clients do not need to know the internal location of every service.

Client
  ↓
API Gateway / Reverse Proxy
  ├── Users Service
  ├── Orders Service
  ├── Payments Service
  └── Notifications Service

Reverse Proxy vs API Gateway

A reverse proxy and an API gateway can overlap in functionality, but they are not always identical. A reverse proxy primarily forwards and manages network traffic, while an API gateway often provides additional application-aware features such as authentication, request transformation, API policies and service-specific routing.

Common Reverse Proxy Software

Several popular web servers and networking platforms can operate as reverse proxies. The appropriate choice depends on traffic requirements, configuration preferences, existing infrastructure and required features.

Common Mistakes

• Forwarding requests without preserving important HTTP headers.
• Trusting X-Forwarded-For from untrusted clients.
• Exposing backend services directly to the public internet.
• Caching private responses incorrectly.
• Forgetting to configure appropriate timeouts.
• Using incorrect upstream health or load-balancing settings.
• Creating routing rules that accidentally expose internal endpoints.

Best Practices

• Expose the reverse proxy instead of unnecessary backend ports.
• Use HTTPS for public traffic.
• Configure forwarding headers consistently.
• Trust proxy headers only from known proxy infrastructure.
• Set appropriate connection and request timeouts.
• Use caching only for responses that are safe to cache.
• Monitor backend health and proxy errors.
• Apply rate limiting where appropriate.
• Keep proxy and backend configurations documented.

Frequently Asked Questions

Helpful Server Tools

An Nginx Config Generator helps create reverse proxy and web server configurations, an Apache Config Generator assists with Apache server configuration, an HTTP Header Viewer helps inspect request and response headers, an HTTP Request Builder is useful for testing HTTP requests, and a Cache-Control Generator helps create cache directives for controlling browser and proxy caching.

Conclusion

A reverse proxy provides a flexible layer between clients and backend servers. It can route requests, terminate HTTPS, distribute traffic, cache responses, forward important headers and add security controls without requiring every backend service to handle these responsibilities independently. Reverse proxies are therefore a fundamental component of many modern web architectures, from simple websites running behind Nginx to large distributed systems with multiple application services.