Reverse Proxy

A reverse proxy is a proxy placed in front of one or more servers. It accepts client requests as the public service endpoint and forwards them to an appropriate backend.

Motivation

Publishing every backend directly exposes deployment details and duplicates cross-cutting concerns. A reverse proxy provides a controlled entry point for routing, TLS termination, authentication, rate limiting, caching, observability, and gradual service changes.

Mental model

The client believes it is communicating with the service. The reverse proxy receives that request, selects or identifies a backend, forwards the request, and returns the backend response. Backend topology can change without changing the public endpoint.

Reverse proxy versus forward proxy

• A forward proxy represents clients reaching external services.
• A reverse proxy represents servers receiving external traffic.

Clients often need explicit configuration to use a forward proxy. Clients generally do not need to know that a reverse proxy exists.

Common responsibilities

• Route requests by host, path, header, or protocol.
• Terminate and renew TLS certificates.
• Distribute traffic across healthy backends.
• Apply authentication, limits, and security policies.
• Cache suitable responses or static assets.
• Preserve request metadata through standardized forwarding headers.

Common mistakes

• Treating reverse proxy and load balancer as exact synonyms. Load balancing is one possible reverse-proxy responsibility.
• Trusting forwarding headers from arbitrary clients rather than replacing or validating them.
• Ignoring timeout, retry, buffering, and request-size behavior.
• Creating a single unprotected bottleneck or failure point.

Related concepts

Reverse proxy connects to proxy, load balancer, web server, API gateway, TLS, caching, and ingress.