7

I understand that in computing, the word "proxy" means "medium" or entity Y that mediates between entity X to entity Z.

I have often heard on sysadmins using the webserver software Nginx not as a webserver software but as a "reverse proxy" for another webserver software (which does act as the webserver in such scenario) such as Apache.

I never found reading material which I could consider "didactic" about the term "reverse proxy" in that context and I would like to try to ask the talented and very experienced users of this website what is a "reverse proxy" in webmastering?

2
  • 6
    Cloudflare has an excellent article about the subject: cloudflare.com/learning/cdn/glossary/reverse-proxy Feb 7, 2021 at 19:30
  • It's a reasonable question - both proxies and reverse proxies forward traffic from multiple users to multiple servers. One way to remember which is which, is that for normal/forward proxies their users (the sources) are what's limited/counted, and the destinations can be unlimited (i.e. few users connect to the internet). In the reverse situation the source can be unlimited (anyone on the internet), but the number of destination servers are limited (even if there could be millions of them at Google for example) -- the internet connects to a few servers, essentially.
    – chexum
    Feb 8, 2021 at 12:25

5 Answers 5

15

A reverse proxy is a service (server) that:

  • Appears to be a web server to clients (ie end users)
  • Appears like a web client (browser) to a web server.

An example of a reverse proxy would be something like Cloudflare or CloudFront.

They can serve a range of purposes including -

  • Adding https to a site which cant handle it natively (or where https is very compute intensive)
  • Providing reliability/scalability by divying up requests to multiple servers
  • Adding a layer of security by hiding the actual site location.
  • Unifying different sites under a single domain.

(Another way to look at is litereally - it acts like a proxy, but in reverse. Instead of acting on the web clients behalf it acts on the web servers behalf)

2
  • 7
    Additional uses of reverse proxies: Removing port numbers from URLs, converting subdomains into directories, moving requests to edge nodes, and caching resources to improve performance. Feb 8, 2021 at 15:17
  • @StephenOstermiller And handling HTTPS termination locally as a sidecar. Feb 8, 2021 at 22:14
4

An HTTP proxy is a specific kind of server which will receive HTTP requests and forward them to another server.

The original use of proxies included:

  • Enable users on an internal network without full Internet access to browse the web: you would not have any direct TCP/IP connection to the whole internet, only to internal servers, and one of these, the proxy, which would have access to the rest of the internet, would act as a gateway.

  • Perform access control: only some users are allowed to access "the web" (HTTP servers on the Internet), or users are allowed to only access some web servers (using either whitelists: only listed servers can be accessed, or blacklists: all servers but those listed can be accessed), or a combination of both.

  • Perform content control: this can include checking for "sensitive" stuff, like p0rn or malware. It could just block videos. Or downloads of executable files, zips, or whatever.

  • Caching. This was very common back in the 90s to save on bandwidth: the proxy would cache the results of request, so subsequent users (or the same one) requesting the same URL would get the data from the local cache. Useful when links to the Internet were slow and congested, though it requires many users to access the same ressources to be useful.

  • Censorship and sniffing of communications. By terminating the HTTP(S) connections at the proxy, data can be decrypted there before being encrypted again on the other leg, which allows all sorts of legitimate and less legitimate stuff to happen.

  • A combination of the above, and probably a few more I forget.

This type of proxy is still relatively common in enterprise networks, mostly for access and content control. It is also a common tool in countries where the regime wants to know what you do, read, or say.

In most cases, the proxy is configured (though usually automatically) in the browser. In some cases, a transparent proxy can be set up (though this is a lot more difficult with SSL/TLS).

With this type of proxy, the browser can request any URL (provided the proxy is willing, of course), and the communication is usually thought as "internal to external".

The other type of proxy, which came a tiny bit later, is the reverse proxy. In this case, we're doing the opposite: people from all over the Internet will go through this proxy before reaching the final server.

This is useful for:

  • Load balancing / fault tolerance: one or more proxies will receive the traffic, and then forward to farms of servers based on availability, load, etc.

  • Separation of traffic: some web servers may be specialised. For instance, mixing on the same server both static files (CSS, JS, images, videos, etc.) and dynamic content (PHP, .NET, Java...) may be suboptimal. A reverse proxy may redirect traffic to different servers based on the request.

  • Hiding internal architecture details. You could have lots of different ressources (pages) on the same domain, but served by lots of different servers with different technologies. One bit could be PHP, another Java. Even with the same tech, they could use very different stacks, access different databases, etc.

  • Caching. Frequently requested ressources can be cached on the proxy.

  • SSL/TLS termination. To reduce the CPU requirements for TLS encryption/decryption on the server, the proxy could do that instead.

  • CDN: a CDN can be caching + load balancing + fault tolerance pushed to the extreme: you put proxies all over the world, and they serve files from the local cache (a lot quicker), and if not, get the data from the origin server.

  • Security: the proxy could do all sorts of filtering on URLs and submitted data to block malicious requests.

  • And probably a lot more cases which I forgot about.

Note that the "original" proxies are now often called "forward proxies" to differentiate them from reverse proxies.

Note that many HTTP server apps, including Apache and Nginx can actually do both HTTP serving and proxying in one or both directions. You can have setups where the same server will both serve local resources for some paths, and proxy to another server for others.

2

No guys I don't think he's talking about a 3rd party reverse proxy because of his mention of nginx.

People will setup reverse web proxies for various reasons, one of which is to spread the load over multiple web servers. Nginx would process the request and then decide where to send it.

Nginx was actually used extensively in corporate networks as an internal reverse proxy. So all your web requests would go through a local nginx server and that server would process the request and decided (if it matches a filter or some thing) where to send it.

3
  • 3
    The technology used does not contradict my answer - my answer explains what a reverse proxy does - which was the question. Nginx is but one implementation. I only mentioned cloudflare as an example as its easily understood.
    – davidgo
    Feb 8, 2021 at 0:28
  • Coudflare does A LOT of other things and I thought your answer was too broad.
    – 8vtwo
    Feb 9, 2021 at 21:17
  • If you believe you can answer better I would encourage you to add your own answer. - thats the way this site works. Good answers rise to the top to help other people.
    – davidgo
    Feb 9, 2021 at 23:09
2

One specific reason you might use a reverse proxy is if you're using an application server that's intentionally missing certain features because it's designed to work behind a reverse proxy.

Unicorn and Gunicorn are well-known examples. These application servers are designed to do a limited job very quickly and simply. But there are things they do poorly, especially dealing with slow, high-latency clients, and features they don't support, such as HTTP keep-alive, which would pose problems when dealing with production-scale traffic from the internet. And that's fine, because Nginx exists and knows how to do those things really well. Nginx can handle everything it knows how to do and then proxy the requests that need to go to the application server to unicorn/gunicorn. This answer goes into more detail on how this works and the reasons for this design.

3
  • Why would you intentionally use a server with some missing features if you actually need the features and need to add Nginx after that ? Why not directly serve it with Nginx ?
    – Fabich
    Feb 8, 2021 at 8:23
  • 1
    @Fabich - people do exactly that with Node.js. So I guess the answer is they work with a language that is not supported by Nginx.
    – Davor
    Feb 8, 2021 at 8:34
  • 1
    @Fabich It's common in some stacks to want to separate the web server, which can be hardened to deal with random internet traffic and optimized to serve small static files very quickly, from the application server, which has heavy threads/processes with considerable overhead (interpreter with all necessary libraries loaded and initialized, database connection, etc...). Any model like this means the web server needs a protocol to pass the request data to the application server. That protocol might be HTTP or it might be something like like uwsgi. Feb 8, 2021 at 8:51
1

Proxy

I understand that in computing, the word "proxy" means "medium" or entity Y that mediates between entity X to entity Z

In networking "proxy" has an even more specific meaning. Especially when it comes to HTTP.

An HTTP proxy specifically refers to a service that usually runs on your LAN (usually at the router or firewall) that allows your web browser to make HTTP requests to the internet from a completely firewalled network.

We've gotten so used to NAT and more recently IPv6 that we've kind of forgotten about web proxies. But way back in the late 90s and early 2000 it was common for corporate LANs to not be connected to the internet at all. The only thing connected to the internet would be your HTTP proxy. So you can't do bittorrent or ssh or ftp etc. All you had was browser access. This (happily) is very uncommon these days.

To this day all borwsers have a way to configure proxy settings even though it is almost never used by anyone:

Chrome proxy settings

Reverse Proxy

Since a proxy allows browsers to connect to the internet indirectly from a fully firewalled network, the software that allows web servers to connect to the internet indirectly from a fully firewalled network was logically called a reverse proxy. Even if that logic does not quite apply today.

6
  • 2
    This answer is wrong. A proxy does not need to be on a lan, and this was never the case. More relevantly, your definition of a reverse proxy is very wrong. Nothing about a reverse proxy allows (or allowed) a web server to connect to the Internet indirectly - although it does allow a server to handle proxied requests it cant initiate them. [I know - I ran an ISP on a large island in the early days of Internet and we implemented proxies to save precious bandwidth. I also implemented reverse proxies for schools and SaaS providers]
    – davidgo
    Feb 8, 2021 at 11:12
  • @davidgo You are talking about caching proxies which are transparent proxies and is a completely different thing. The word "proxy" as used by web browsers and the sysadmins usually refer specifically to HTTP proxies using the CONNECT request. It doesn't have to be on your own LAN of course, proxy list websites are still around though less popular these days due to VPN becoming more popular. But normally it would be on your LAN.
    – slebetman
    Feb 8, 2021 at 11:42
  • .. Also, I think you and I are saying the same thing about reverse proxies but there is a bit of miscommunication. You said it does allow a server to handle proxied requests which is not quite true but let's not be picky about what is a proxied request. This is exactly what I mean by connecting a server indirectly to the internet. You and I are saying the same thing. A server by definition handles requests. A reverse proxy connects the server to the internet where the firewall blocks all direct connections to the server in order to allow the server to respond to HTTP requests
    – slebetman
    Feb 8, 2021 at 11:44
  • Remenber.. there are servers not connected to the internet at all. For example my printer server at my house is not connected to the internet at all so I cannot send a print job to my printer from Starbucks. I think the misunderstanding is you are using the word connect to mean "make a request" but I am using the word connect to mean "connect"
    – slebetman
    Feb 8, 2021 at 11:46
  • I still disagree on the following - A reverse proxy is not neccessarily used to overcome firewall blocks (although this is a common case) - note Cloudflare. A transparent proxy is an implementation of a forward proxy (Dont trust me? CISCO state it (cisco.com/c/en/us/support/docs/security/web-security-appliance/… under WSL configuration). || Forward proxies are still common outside LANs as an alternative to privacy VPNs - eg myprivateproxy.net || Reverse proxies do not give servers behind them any internet access in either direction...
    – davidgo
    Feb 8, 2021 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.