Reverse Proxy
A server that sits in front of backend apps and forwards client requests to them.
What is a reverse proxy?
A reverse proxy accepts incoming client connections and relays them to internal servers. Clients think they are talking to one host; the proxy handles routing to the correct backend.
Forward vs reverse proxy
| Type | Sits near | Example |
|---|---|---|
| Forward proxy | Client | Corporate HTTP proxy |
| Reverse proxy | Server | NGINX in front of app servers |
Common capabilities
- TLS termination — decrypt HTTPS at the proxy
- Caching — store static responses
- Compression — gzip/brotli responses
- Security — hide internal topology, WAF rules
- Routing — path-based rules to different services
Popular implementations
NGINX, HAProxy, Envoy, Traefik, Caddy, and cloud-managed equivalents (Cloudflare, AWS ALB).
In modern stacks
Reverse proxies often sit between a load balancer and application pods. Service meshes extend this with sidecar proxies for mTLS and fine-grained traffic policies.
What people get wrong
- Forgetting forwarding headers. Without
X-Forwarded-For/X-Forwarded-Proto, backends see the proxy’s IP and think everything is HTTP — breaking logs, rate limits, and redirect logic. - Buffering surprises. Default response buffering breaks Server-Sent Events and streaming responses (a constant gotcha for LLM apps — see streaming); disable it on streaming routes.
- Timeout mismatches. A 30-second proxy timeout in front of a 60-second backend produces mysterious 502/504s; align the chain, longest at the edge.
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.