Proxies — Forward and Reverse Proxies

A forward proxy sits between the client and the internet. The client's request goes to the proxy, which forwards it to the server. The server sees only the proxy's IP — the client is anonymous.

Use cases: (1) Corporate internet filtering — block social media on company networks. (2) Bypassing geo-restrictions — use a proxy in another country to access blocked content. (3) Caching — proxy caches responses and serves repeated requests without hitting the internet. (4) Logging — log all outbound requests for security monitoring.

A forward proxy requires client-side configuration. The client must explicitly use the proxy (set HTTP_PROXY env var, configure system proxy, or use a browser proxy plugin).

A reverse proxy sits in front of backend servers. Clients send all requests to the reverse proxy — they don't know (or need to know) which backend server is actually serving them. The reverse proxy forwards requests to the appropriate backend and returns the response.

Use cases: (1) Load balancing — distribute requests across multiple backend servers. (2) SSL termination — decrypt HTTPS at the proxy; backends use plain HTTP. (3) Caching — cache static content and API responses. (4) Security — hide backend server IPs and ports; filter malicious requests (WAF). (5) Compression — compress responses before sending to clients. (6) Authentication — verify JWT tokens before forwarding to backend.

Common reverse proxies: Nginx, HAProxy, AWS ALB, Cloudflare. In system design, "put a load balancer in front of the app servers" is the same as "use a reverse proxy."

All load balancers are reverse proxies, but not all reverse proxies are load balancers. A reverse proxy can route to just one backend (for SSL termination or caching) without load balancing. In practice, the terms are often used interchangeably in system design interviews — both refer to a server in front of your backend fleet.

Nginx can act as both a reverse proxy and a load balancer simultaneously: proxy_pass to an upstream block with multiple servers and round-robin or least-connections balancing.

An open proxy is a forward proxy accessible to any internet user — not just authorized clients. Open proxies are frequently abused by spammers, scrapers, and attackers to hide their origin. Most corporate and cloud networks block connections to known open proxy IP ranges.

Security considerations: (1) Rate limit requests from proxy IPs (they aggregate many users). (2) Check IP reputation databases for known proxy/VPN IPs. (3) Use CAPTCHAs for suspicious traffic patterns. (4) Log the X-Forwarded-For header (set by the proxy to indicate the original client IP) for auditing.