Reverse Proxy

A proxy receives requests on behalf of internal servers

A Reverse Proxy sits in front of an application: the client establishes a connection to the proxy, and the proxy chooses an internal server and forwards the request. The internal topology is hidden from the client, which only knows the external entry point.

client -> reverse proxy -> application

The word reverse distinguishes it from a forward proxy, which represents a client when accessing external resources. A reverse proxy instead represents one or more servers to the client.

What fits naturally on this layer

Because many requests pass through one entry point, this is a convenient place for shared infrastructure concerns that do not belong to application business logic.

• terminate TLS connections and manage certificates centrally;
• route requests by domain or path;
• add or normalize technical headers;
• apply request-size limits, timeouts, or basic filtering rules;
• compress suitable responses and serve some static content.

For example, one external address may route /api to the application and /static to a separate static-content handler. The client does not need to know that different internal components sit behind those paths.

Reverse Proxy and Load Balancer are not the same thing

A single product can perform both roles, which is why the terms are often mixed together. But the responsibilities differ: a reverse proxy is primarily an intermediary and external entry point, while a load balancer is responsible for distributing load across multiple suitable instances.

In a simple system, one reverse proxy may forward requests to a single application server. When there are multiple instances, the same layer may also perform balancing or forward traffic to a separate load balancer.