Reverse Proxy

A reverse proxy is an intermediary server that sits in front of one or more application servers and accepts requests from internet clients on their behalf. To the user, the reverse proxy is the only visible entry point — it is what they connect to, while whatever happens deeper in the infrastructure stays hidden. As a result, the backend is insulated from direct contact with the public network.

How a reverse proxy works

A client sends a request to the address where the reverse proxy is listening. The proxy inspects the request and forwards it to the appropriate backend (upstream) server, then receives the response and returns it to the client. Along the way it can perform several jobs:

• SSL termination — decrypting HTTPS traffic in one place, offloading the application servers,
• load balancing — distributing requests across multiple instances (the load balancer function),
• caching — serving responses from cache without touching the backend,
• compression and optimisation of headers and content,
• protection — hiding the topology and filtering malicious requests.

The most popular software for this role includes nginx, HAProxy, Apache and Traefik.

Reverse proxies in practice

Reverse proxies are nearly ubiquitous in modern web architecture. They let you host many applications on a single IP address (routing by domain name), manage certificates centrally, expose containerised services securely, and roll out deployments with zero downtime. In practice you place a reverse-proxy layer in front of the application to terminate HTTPS and spread traffic across backend nodes — a common part of running an app on a VPS server. A CDN also acts as a reverse proxy, serving as a global caching layer in front of the origin server.