Skip to content
AI360Xpert

Proxy & Reverse Proxy

Forward vs Reverse Proxy Architecture
Forward vs Reverse Proxy Architecture

Overview

A proxy is an intermediary server that sits between a client and a destination server, intercepting and forwarding requests. A forward proxy sits in front of clients and protects them from the internet, while a reverse proxy sits in front of servers and protects them from clients.

🧠 Mental model: A forward proxy is a personal shopper - you tell them what you want, and they go out to the stores (the internet) to buy it for you, hiding your identity. A reverse proxy is a receptionist at a large company - outside callers talk to the receptionist, who routes the call to the right employee (server) without revealing their direct extension.

Key Concepts

Forward Proxy

Often just called a "proxy." It acts on behalf of the client. When a client wants to access a website, the request goes to the forward proxy first, which fetches the data from the internet and returns it to the client.

  • Anonymity: Hides the client's IP address from the destination server.
  • Content Filtering: Blocks access to certain websites (e.g., corporate firewalls blocking social media).
  • Caching: Caches frequently accessed external resources to save bandwidth for the local network.

Reverse Proxy

Acts on behalf of the server. Clients on the internet send requests to the reverse proxy's IP, completely unaware of the backend servers hidden behind it.

  • Load Balancing: Distributes incoming traffic across a pool of backend servers (most load balancers are reverse proxies).
  • Caching & Static Routing: Serves static assets (images, CSS) directly, or caches dynamic responses to offload the backend.
  • Security & TLS Termination: Acts as a unified defense layer, handling SSL encryption/decryption, rate limiting, and blocking malicious requests (WAF).
Aspect Forward Proxy Reverse Proxy
Placement Between clients and the internet Between the internet and backend servers
Protects The client network The server infrastructure
Primary use cases Anonymity, outbound filtering, corporate security Load balancing, caching, TLS termination, API Gateway

Trade-offs

Using a reverse proxy adds an extra network hop, slightly increasing base latency. It also introduces a single point of failure (SPOF) if not deployed redundantly. However, the benefits of unified security, centralized caching, and traffic routing overwhelmingly outweigh these costs in modern distributed systems. Forward proxies are less relevant in standard web app design but remain critical for corporate networks and web scraping infrastructures.

Interview Tips

  • If asked to scale a web server, immediately place a reverse proxy (like Nginx, HAProxy, or Envoy) in front of it to handle TLS termination and static file serving.
  • Mention that an API Gateway is essentially a specialized reverse proxy that adds cross-cutting concerns like authentication, billing, and request translation.
  • Don't confuse the two: forward proxies are for outbound traffic, reverse proxies are for inbound traffic.

Summary

  • A forward proxy hides the client from the server; a reverse proxy hides the server from the client.
  • Forward proxies are used for outbound traffic filtering, anonymity, and corporate networks.
  • Reverse proxies are used for load balancing, TLS termination, and inbound security.
  • Almost all modern distributed systems use a reverse proxy at their edge.
  • An API Gateway is a specialized form of a reverse proxy.