How Reverse Proxies Work
BeginnerA reverse proxy is a server that sits in front of one or more backend servers and forwards client requests to them. To the outside world it looks like the application; the real servers stay hidden behind it. This single entry point is the natural place to handle cross-cutting concerns: load balancing across backends, TLS termination, caching, compression, request routing, and security. It differs from a forward proxy, which sits in front of clients rather than servers.
Think of a receptionist at a company front desk
When you call a company, you reach the receptionist (reverse proxy), not a specific employee. The receptionist decides who should handle your call (routing), spreads calls across available staff (load balancing), screens unwanted callers (security), and can answer common questions instantly from a note (caching) without disturbing anyone. Callers never need to know the staff direct numbers — the front desk is the single, controlled point of contact.
Step by Step
Key Concepts
Reverse vs Forward Proxy
A reverse proxy sits in front of servers, representing them to clients. A forward proxy sits in front of clients, representing them to servers (e.g., a corporate proxy that filters outbound traffic). They face opposite directions.
Single Entry Point
The reverse proxy is the one public endpoint for many backends, making it the ideal place to centralise TLS, routing, load balancing, caching, and security instead of duplicating them per service.
TLS Termination
Handling the HTTPS handshake at the proxy and forwarding plain HTTP to backends, centralising certificate management and offloading encryption cost from application servers.
Reverse Proxy vs API Gateway
An API gateway is a specialised reverse proxy focused on APIs, adding features like authentication, request transformation, rate limiting, and API-specific routing on top of basic proxying.
Key Facts
- The key distinction: a reverse proxy fronts servers (hiding backends from clients), while a forward proxy fronts clients (hiding clients from servers).
- Because it is the single entry point, the reverse proxy is the natural home for TLS, load balancing, caching, compression, and security — implemented once instead of per service.
- Common reverse proxies include Nginx, HAProxy, Envoy, and cloud load balancers; an API gateway is a reverse proxy specialised for API traffic.
Real-World Applications
Fronting a web application
Nginx as a reverse proxy terminates HTTPS, serves static files, load-balances dynamic requests across app servers, and hides those servers from the internet — the standard production topology.
Routing microservices behind one domain
A reverse proxy maps paths like /orders and /users to different backend services under a single public domain, so clients see one API while many services handle it behind the scenes.
Frequently Asked Questions
What is a reverse proxy?
A reverse proxy is a server that sits in front of one or more backend servers and forwards client requests to them, then relays the responses back. To clients it appears to be the application itself, while the real servers remain hidden behind it. This single entry point is used to handle cross-cutting concerns like load balancing, TLS termination, caching, request routing, and security in one central place.
What is the difference between a reverse proxy and a forward proxy?
They face opposite directions. A reverse proxy sits in front of servers and represents them to clients — clients connect to the proxy without knowing the backends. A forward proxy sits in front of clients and represents them to servers — for example, a corporate proxy that all employees browse through to filter or log outbound traffic. In short, a reverse proxy hides servers from clients, while a forward proxy hides clients from servers.
Why use a reverse proxy?
Because it is a single entry point for many backends, a reverse proxy is the ideal place to centralise functionality: load balancing across instances, TLS/HTTPS termination, caching and compression, request routing, and security measures like rate limiting and hiding backend addresses. Implementing these once at the proxy is simpler and more consistent than duplicating them in every backend service, and it improves performance, scalability, and security.
What is the difference between a reverse proxy and an API gateway?
An API gateway is a specialised type of reverse proxy focused on API traffic. In addition to basic proxying, routing, and load balancing, it typically adds API-centric features such as authentication and authorization, request/response transformation, rate limiting per client, API key management, and aggregation of multiple backend calls. A plain reverse proxy handles general traffic forwarding, while an API gateway layers API management concerns on top.