Proxy vs Reverse Proxy

Both types of proxy stand between a client and a server. Which one faces which way flips the use case entirely. Candidates mix them up all the time. Interviewers notice.

Almost every production web stack has one. The reverse proxy:

• Terminates TLS. Handles the handshake once; backends speak plain HTTP internally. Cheaper than TLS at every app server.
• Load balances. Picks which upstream instance gets the request (this overlaps with load balancer territory).
• Caches. Stores responses for common URLs. Next request served from proxy memory, upstream not hit.
• Compresses. Gzip/Brotli responses before sending to client.
• Serves static files. Nginx serves /static/* from disk directly; dynamic requests to the app.
• Adds/strips headers. Injects X-Forwarded-For (so backend knows client IP), strips internal headers.
• Enforces security. Blocks bad user-agents, applies WAF rules, rate-limits IPs.
• Hides topology. "example.com" is one IP; behind it are 47 containers, 3 services, 2 regions. Clients see none of it.

• Corporate filtering. Enterprise makes every employee's browser route through a proxy that blocks Facebook, logs every URL, scans for malware.
• Caching. ISP-level proxy caches popular content, saves bandwidth. Less common now thanks to CDNs, but still exists.
• Egress control. Your servers in a private VPC need to reach external APIs. Route all egress through a proxy with allow-listed destinations — security + audit.
• Circumvention. VPNs are a kind of forward proxy — make your traffic look like it came from elsewhere.
• Anonymity. Tor is a multi-hop forward proxy.

Reverse proxies introduce a subtle trap: your app server sees the proxy's IP, not the client's. If you log "client IP" naïvely, every entry says "the proxy." If you rate-limit by IP, one bad user defeats it by hiding behind the proxy.

Solution: the proxy sets X-Forwarded-For: <client-ip> (and X-Real-IP, Forwarded per RFC 7239). Your app reads that header instead of the TCP peer address.

Trap: this header is client-controllable. A curl user can send X-Forwarded-For: 127.0.0.1. Your proxy must strip any inbound X-Forwarded-For and set a fresh one. Otherwise attackers spoof their apparent IP.

With multiple proxies (CDN → LB → app), the header contains a comma-separated chain. Parse it carefully; the leftmost entry is the original client (assuming all proxies in the chain are trusted and set the header correctly).

URL shortener puts Nginx in front for static redirect caching. News feed uses Envoy as reverse proxy with stream-level load balancing. E-commerce uses CDN as the outermost reverse proxy layer.