Proxies

A proxy is a server that stands between a client and another server. It receives the request, and it passes the request on.

The reason to use one is control. A proxy gives you a single place where you can see the traffic, change it, block it, or store a copy of it. You get that place without changing the clients and without changing the servers.

Hiding an address is one result of using a proxy. It is not the purpose. Almost every proxy in a real system is there to do a job: cache responses, handle TLS, block bad requests, or route them somewhere.

There are two kinds, and the difference is which side the proxy works for.

Forward Proxy

A forward proxy sits next to the clients and works for the clients. Requests reach the proxy instead of going straight to the internet, either because the client is configured to use it or because the network redirects them to it.

A company puts one in front of its office network. Then it can:

• block sites that employees should not reach
• keep a log of what was requested
• keep one cached copy of a file that many people download
• require the user to sign in before any request leaves the network

The outside server sees the request coming from the proxy, so it does not learn the address of the individual user. That is a side effect of the proxy standing in the middle.

Reverse Proxy

A reverse proxy sits in front of the servers and works for the servers. The client sends its request to a normal public address and does not know that a proxy is there at all.

This is the far more common kind in system design. A reverse proxy can:

• choose which server should handle each request
• keep a cached copy of common responses
• handle TLS, so the servers behind it can speak plain HTTP
• send /api to one group of servers and /images to another
• block requests that look like an attack, and limit how many requests one client can send
• compress responses

Because the client only ever talks to the proxy, you can change everything behind it. Add servers, move a service to a new machine, or split one service into two, and the client sees the same address.

The Difference in One Line

A forward proxy controls what the clients can reach. A reverse proxy controls how requests reach the servers.

The same piece of software, such as NGINX, can do either job. What makes it forward or reverse is where you put it and whose side it acts for, the clients or the servers.

Is a Load Balancer a Proxy?

Usually yes. A load balancer that reads the request, called a layer 7 load balancer, is a reverse proxy whose main job is choosing between servers. One that only forwards packets or connections at the transport layer never reads the request, so it spreads load without acting as a proxy.

The two words describe the same box from different angles. "Reverse proxy" describes its position, standing in front of the servers. "Load balancer" describes one of its jobs, spreading requests. Most reverse proxies can balance load, and any load balancer that reads the request is a reverse proxy.

A related component is compared in Load Balancer vs API Gateway. The forward and reverse cases are compared in Proxy vs Reverse Proxy.

Collapsing Identical Requests

A proxy sees all the traffic passing through it, and that lets it do something the servers cannot.

Suppose fifty clients ask for the same file at the same moment, and the file is not in the cache. Without a proxy, fifty requests reach the origin server, which reads the same file fifty times.