What is a reverse proxy? Load balancing, TLS and caching explained

The plain idea, and the confusion with a forward proxy

A reverse proxy receives requests from clients on the internet and forwards each one to an appropriate backend server, then returns that server’s response to the client — who never needed to know which backend actually handled it. The proxy acts on behalf of the servers.

A forward proxy does something that sounds similar but points the opposite way: it sits in front of clients and represents them, forwarding their requests out to the internet — commonly used to filter traffic or hide client identity, such as a corporate proxy that all employee traffic passes through. The direction of “who it represents” is the whole distinction: a forward proxy represents clients to the internet; a reverse proxy represents servers to clients. Mixing the two up is a very common source of confusion, worth fixing early.

What a reverse proxy is used for

A single reverse proxy typically does several jobs at once, which is a large part of why the pattern is so widespread:

• Load balancing — spreading incoming requests across multiple backend servers; our explainer on what a load balancer is covers this in depth, and it is worth being explicit that a load balancer is itself a kind of reverse proxy, specialised for distributing traffic.
• SSL/TLS termination — handling the encryption and decryption of HTTPS traffic at the proxy, so backend servers can deal in plain, unencrypted traffic internally and don’t each need their own certificates managed.
• Caching — storing a copy of a response and serving it directly for repeat requests, without troubling the backend; our explainer on caching covers the broader idea of trading storage for speed.
• Security and hiding backend structure — the internal layout, server count and software versions behind the proxy are never exposed directly to the internet.
• Routing — directing a request to a different backend service depending on its path or hostname, which is how one public domain can front many separate internal services.

How it relates to API gateways and CDNs

Both an API gateway and a content delivery network (CDN) build on the reverse-proxy pattern rather than replacing it. An API gateway is a reverse proxy specialised for APIs — adding concerns like authentication, rate limiting and request transformation on top of the basic forward-the-request job. A CDN is a reverse proxy distributed across many geographic locations, caching content close to users so requests don’t have to travel back to the origin server every time. Understanding the plain reverse-proxy pattern first makes both of these easier to place: they are the same idea, specialised for a purpose.

Examples, named accurately

Nginx is one of the most widely used software reverse proxies, commonly deployed to handle load balancing, TLS termination and caching in front of an application. The major clouds offer managed equivalents: AWS provides the Application Load Balancer (ALB) for layer-7 routing and CloudFront as its CDN, and Azure provides Application Gateway. These managed services save a team from running and patching the proxy software themselves, while providing the same underlying reverse-proxy capabilities.

Why it matters for architecture

Putting a reverse proxy in front of backend servers is one of the simplest, highest-leverage architectural decisions available: it adds resilience (traffic can be shifted away from a failing backend without the client noticing), a single place to enforce security policy, and a natural point to add caching without touching application code. Most production web architectures include one somewhere, even when it isn’t the first thing anyone thinks to draw.

Where reverse proxies appear in certification study

The pattern is core material on the architecture-focused exams. The AWS Solutions Architect Associate (SAA-C03) exam expects fluency with ALB and CloudFront as reverse-proxy services, including when to terminate TLS at the edge and how caching interacts with backend load. The AWS Developer Associate (DVA-C02) exam expects you to reason about how an application behaves sitting behind one. The Azure Administrator Associate (AZ-104) exam covers Application Gateway in the same role on Azure. Exam scenarios frequently test whether you can tell a reverse proxy, a load balancer, a CDN and an API gateway apart — which, as this article covers, are really variations on one underlying pattern.