Reverse Proxy
A server that sits in front of backend servers and forwards client requests to those servers.
Detailed Explanation
Reverse proxies (like Nginx or HAProxy) are used for load balancing, security (hiding backend server IPs), SSL termination, and caching. They act as a single entry point for an application, allowing you to scale backend services horizontally without changing the client's URL. They are essential for building high-availability web systems.
Quick Summary
A reverse proxy sits between clients and one or more backend servers, accepting traffic on the public side and forwarding it to internal services. It handles TLS, caching, compression, and routing without the clients knowing what's behind it.
Key Takeaways
- Forward proxy hides the client from the server; reverse proxy hides the server from the client.
- Common jobs: TLS termination, gzip/brotli compression, path-based routing, response caching, authentication enforcement.
- Hides internal topology, the public sees one IP and hostname regardless of how many backends are behind.
- Often the same software that does load balancing (Nginx, HAProxy, Envoy, Caddy, Traefik).
- Modern cloud equivalents: AWS ALB/CloudFront, GCP Load Balancer, Cloudflare, all act as managed reverse proxies.
When to use it
- Terminating HTTPS once at the edge and talking HTTP to backends inside a trusted network.
- Hosting multiple apps under one domain via path or subdomain routing (/api → backend, /app → frontend).
- Adding a caching layer in front of an origin server to reduce load and latency.
- Injecting security headers, rate limiting, and WAF rules without changing application code.
Common Mistakes
- Forgetting to preserve the original client IP (X-Forwarded-For) so backend logs and rate limiters see the proxy IP instead.
- Letting the proxy buffer huge uploads without configuring limits, causing OOMs at the edge.
- Skipping a healthcheck and routing traffic to a dead backend until users complain.
- Terminating TLS at the proxy but speaking plaintext on a network you do not actually control, encrypt internal hops too.
Reverse Proxy, Frequently Asked
Reverse proxy vs. load balancer, same thing?
Overlapping. A reverse proxy can do load balancing (and usually does). A load balancer is anything that distributes traffic; not every load balancer is a full reverse proxy with caching and Layer 7 features.
Do I need a reverse proxy in front of Node/Go/Rust apps?
Modern app servers can serve HTTPS directly, but a reverse proxy in front gives you TLS rotation, static-asset caching, multiple-app routing, and graceful restarts that are painful to implement in the app itself.
Nginx vs. Caddy vs. Traefik vs. Envoy?
Nginx is the venerable workhorse. Caddy auto-provisions HTTPS via Let's Encrypt and has a friendly config. Traefik integrates with container schedulers (Docker, Kubernetes) and discovers services automatically. Envoy is the heavy-duty proxy underpinning service meshes.