Proxy & Reverse Proxy
Overview
Proxies act as intermediaries between clients and servers. A Forward Proxy (usually just called a Proxy) sits in front of clients and protects them from the internet. A Reverse Proxy sits in front of servers and protects them from the internet.
Forward Proxy: A corporate personal assistant. You ask the assistant to go buy a coffee. The coffee shop only interacts with the assistant and doesn't know who you are.
Reverse Proxy: A restaurant maitre d'. The customer asks for a table, and the maitre d' decides which waiter serves them. The customer doesn't know how many waiters exist in the back.
Key Concepts
Forward Proxy
Used on the client-side (e.g., within a corporate network). Its main purposes are:
- Anonymity: Hides the client's IP address from external servers.
- Content Filtering: Blocks employees from visiting certain websites.
- Caching: Caches frequently accessed external resources to save bandwidth.
Reverse Proxy
Used on the server-side (e.g., NGINX, HAProxy). It intercepts requests from the internet before they reach your backend servers. Its main purposes are:
- Load Balancing: Distributes incoming traffic across multiple backend servers.
- Security / DDoS Protection: Hides backend IP addresses and can block malicious traffic before it hits the application.
- SSL Termination: Handles the computationally expensive decryption of HTTPS traffic so backend servers don't have to.
- Caching / Compression: Caches static assets (images, CSS) and compresses responses (gzip) to speed up delivery.
| Aspect | Forward Proxy | Reverse Proxy |
|---|---|---|
| Placement | In front of clients | In front of servers |
| Who does it protect? | The client network | The backend server network |
| Use Case | Corporate VPNs, web filtering, anonymity | Load balancing, SSL termination, caching |
Trade-offs
A reverse proxy is virtually mandatory for modern web applications to provide security and load balancing. The primary tradeoff is that it introduces a single point of failure (SPOF) and a small amount of latency. To mitigate the SPOF, reverse proxies must be deployed in a highly available setup (e.g., using a floating IP or managed cloud load balancer).
Interview Tips
- In system design interviews, when you draw a "Load Balancer," you are almost always drawing a Reverse Proxy (like NGINX or an AWS ALB).
- Mention "SSL Termination" - interviewers love to hear that you are offloading cryptographic overhead from your application servers.
- Differentiate it from an API Gateway: A reverse proxy handles infrastructure concerns (load balancing, SSL). An API Gateway is a type of reverse proxy that also handles application concerns (auth, rate limiting, routing by path).
Summary
- A Forward Proxy sits in front of clients, hiding their identities from the internet.
- A Reverse Proxy sits in front of servers, hiding their identities from clients.
- Reverse proxies are essential for load balancing, SSL termination, and caching.
- Reverse proxies act as a security shield, preventing direct access to application servers.
- Because they sit in the critical path, reverse proxies must be highly available to prevent outages.