Reverse Proxy Fundamentals

A reverse proxy is an intermediary between clients and backend servers. The client connects to the reverse proxy as if it were the origin server. The reverse proxy accepts the request, selects a backend, forwards the request, and relays the response.

This extra hop creates a useful boundary. Clients can use one stable address while backend addresses, ports, and server counts change behind it. The same boundary can terminate TLS, route requests, distribute load, cache eligible responses, and record traffic.

A reverse proxy is not invisible plumbing. It handles a client-facing connection and a separate backend-facing connection. Its configuration can change request meaning, expose the wrong backend, or make every application behind it unavailable.

Follow one request

Start with the smallest mental model:

client → reverse proxy → backend

The client resolves a public name and connects to the reverse proxy. The reverse proxy matches the request against routing rules. A rule may examine the requested host or path. The proxy then selects a healthy backend, creates or reuses a connection to it, and forwards the request.

The backend sends its response to the proxy. The proxy may buffer, cache, or transform that response according to explicit policy. It then sends a client-facing response.