System Design Fundamentals

0% completed

What is a Proxy Server?

On This Page

What a Proxy Is

Forward Proxy

A Forward Proxy Hides the Client

How Clients Use a Forward Proxy

What a Forward Proxy Can Do

Forward Proxies and HTTPS

Collapsed Forwarding

Reverse Proxy

A Reverse Proxy Hides the Server

What a Reverse Proxy Can Do

Forward Proxy vs. Reverse Proxy

Key Takeaways

Practice Questions

An employee opens a news website on a laptop at work. The company network does not send the request straight to the website. It sends the request to a server that contacts the website for the laptop. So the news website sees the company's server, not the laptop.

The news website does something similar on its side. Its many servers stay hidden behind one public server, and that server passes each request to one of them.

So one simple page view passed through two middle servers. Each is a proxy, but they sit on opposite sides and do opposite jobs. This lesson explains both kinds, how they work, and when to use each one.

What a Proxy Is

A proxy is a piece of software or hardware that sits between a client and a server. It facilitates the traffic that flows between them. The client sends its request to the proxy. The proxy forwards the request to the server, receives the response, and passes it back.

Because all traffic passes through it, a proxy can do useful work while the traffic passes. It can hide who sent a request, store responses, block requests, or change them.

The most important question about a proxy is which side it works for.

A proxy that sits with the clients and acts for them is a forward proxy.
A proxy that sits with the servers and acts for them is a reverse proxy.

A forward proxy sits on the client side and acts for the clients, while a reverse proxy sits on the server side and acts for the servers

Forward Proxy

A forward proxy is a server that sits in front of one or more client machines. It acts as an intermediary between those clients and the internet. A forward proxy is also known as a proxy server, or simply a proxy.

Here is how a request flows through it.

A client, like a laptop, requests a resource on the internet, like a web page or a file.
The request goes to the forward proxy first.
The forward proxy sends the request to the internet on behalf of the client.
The website responds to the proxy.
The proxy returns the response to the client.

Three laptops send requests through a forward proxy, and the website sees only the proxy's IP address, not the laptops

A Forward Proxy Hides the Client

Because the proxy sends the request, the website sees the proxy's IP address, not the client's. A forward proxy can hide the identity of the client from the server by sending requests on the client's behalf.

For example, 500 employees may browse the web through one company proxy. Every website they visit sees the same single address, the proxy's.

How Clients Use a Forward Proxy

There are two common ways a client's traffic reaches a forward proxy.

Configured proxy. The browser or operating system is set to send web requests to the proxy's address.
Transparent proxy. The network itself sends web traffic through the proxy, so users do not need to change any settings. Many companies and schools work this way.

What a Forward Proxy Can Do

Forward proxies are typically used for four jobs.

Cache data. The proxy stores copies of popular responses, so repeated requests are answered without going to the internet again.
Filter requests. The proxy blocks requests to websites or content types that a company or school does not allow.
Log requests. The proxy records which sites were visited, for security reviews or rules that an organization must follow.
Transform requests. The proxy changes requests or responses, for example by adding or removing headers, encrypting or decrypting data, or compressing a resource.

Forward Proxies and HTTPS

HTTPS traffic is encrypted, so a normal forward proxy cannot read it. The browser asks the proxy to open a tunnel to the website, using an HTTP method called CONNECT. The proxy then passes the encrypted bytes through without reading them.

So for an HTTPS site, the proxy can see which website the client connects to, and how much data moves. It cannot see the pages, forms, or passwords.

Some companies do inspect HTTPS traffic. They install their own certificate on every company device, which lets the proxy decrypt and check the traffic. Without that certificate installed, the browser would show a warning.

A plain proxy also does not encrypt your traffic on its own. The VPN vs. Proxy Server lesson explains this difference.

Collapsed Forwarding

A proxy receives requests from many clients. That position lets it save work in a way that no single client could.

Suppose several clients request the same data at the same moment, and the data is not in the cache. If every request reached the server directly, the server would read the same data from disk many times.

A proxy can combine those identical requests into one request. The server reads the data from disk only once. The proxy then returns that single result to every client that asked. This technique is called collapsed forwarding. It is also called request coalescing.

Three identical requests for data that is not cached reach the proxy, which sends one request, reads the data once, and returns the result to all three clients

Here is the effect in numbers. Suppose 200 users request the same new report at the same moment, and it is not cached yet. Without collapsed forwarding, the server reads the report 200 times. With collapsed forwarding, it reads the report once, and the proxy sends the result to all 200 users.

This matters most right after a cache entry expires. Without collapsed forwarding, every waiting request can reach the server at the same time. With it, only one request reaches the server, and the rest wait for its answer.

Reverse Proxy

A reverse proxy is a server that sits in front of one or more web servers. It acts as an intermediary between those web servers and the internet.

Here is how a request flows through it.

A client requests a resource from a website.
The request goes to the reverse proxy first.
The reverse proxy forwards the request to one of the web servers behind it.
The web server returns the response to the reverse proxy.
The reverse proxy returns the response to the client.

A reverse proxy receives every request and routes it to API servers, web servers, or image servers, while the client sees only the proxy

A Reverse Proxy Hides the Server

A forward proxy hides the client's identity. A reverse proxy hides the server's identity. The client sees only the reverse proxy's address. It never learns which backend server produced the response, or how many backend servers exist.

Think about requesting a page from facebook.com. Facebook's reverse proxy receives the request. It gets the response from one of many backend servers and returns the response to the client. The client never learns which backend server actually built the page.

What a Reverse Proxy Can Do

Like a forward proxy, a reverse proxy can be used for caching. It can also be used for load balancing or routing requests to the appropriate servers.

Caching. It stores responses, like images or popular pages, so backend servers do less work.
Load balancing. It spreads requests across many backend servers, so no single server is overloaded.
Routing. It sends each request to the right group of servers, often based on the path. For example, /api/ requests go to API servers, and /images/ requests go to image servers.

Reverse proxies also often handle HTTPS encryption for the servers behind them, and they protect those servers from direct attacks. The Uses of Proxies lesson covers these jobs in more detail.

Common reverse proxy software includes Nginx, HAProxy, and Envoy. Many other parts of a system are reverse proxies too. A load balancer, a CDN edge server, and an API gateway all sit in front of servers and act for them.

Forward Proxy vs. Reverse Proxy

	Forward proxy	Reverse proxy
Sits in front of	Client machines	Web servers
Acts on behalf of	The clients	The servers
Whose identity it hides	The client's, from the server	The server's, from the client
Who sets it up	The side making requests, like a company network	The side serving requests, like a website
Typical jobs	Caching, filtering, logging, transforming requests	Caching, load balancing, routing requests
Examples	Office and school web proxies	Nginx, load balancers, CDNs, API gateways

The choice depends on what you want to protect.

To protect the clients on your internal network, put them behind a forward proxy. It hides the clients that make the requests.
To protect your servers, put them behind a reverse proxy. It hides the servers that answer the requests.

Key Takeaways

A proxy is software or hardware that sits between a client and a server to facilitate the traffic between them.
A forward proxy, also called a proxy server, sits in front of client machines. It hides the client's identity from the server by sending requests on the client's behalf.
Forward proxies are used to cache data, filter requests, log requests, and transform requests. For HTTPS, a normal forward proxy sees only which site is visited, not the content.
Collapsed forwarding combines identical requests for uncached data into one request, so the data is read from disk only once.
A reverse proxy sits in front of web servers. It hides the server's identity from the client, and it is used for caching, load balancing, and routing requests.
Use a forward proxy to protect clients, and a reverse proxy to protect servers.

A forward proxy acts for the clients, and a reverse proxy acts for the servers. The next lesson, Uses of Proxies, covers the main jobs that proxies do in real systems.

Practice Questions

Try each question first, then open the answer.

1. A company wants every employee's web traffic to be checked against a list of blocked sites and logged. Which kind of proxy fits, and where does it sit?