miji.beA reverse proxy is an intermediary server that receives requests from clients, forwards them to one or more servers behind it, and returns the responses. Clients communicate only with the reverse proxy and are not aware of the servers behind it. Representative implementations include Nginx, HAProxy, and Envoy. RFC 9110 defines a gateway (also known as a reverse proxy) as an intermediary that acts as an origin server for the outbound connection and translates received requests and forwards them inbound to one or more servers.
The main functions of a reverse proxy are as follows. The first is SSL/TLS termination, which consolidates encryption / decryption in the proxy and reduces the load on the backend. The second is load balancing, which distributes requests across multiple backend servers and increases availability. The third is caching, which holds static content and frequently accessed responses and reduces requests to the backend. The fourth is security, which hides the IP addresses of the backend servers and implements WAF features and DDoS protection.
Reverse proxies are also used in the architecture of URL shorteners. One example is a configuration that, to handle large volumes of redirect requests, accepts requests with Nginx, keeps the redirect destinations of frequently used short URLs in a cache layer, and queries the backend database only on cache misses.
A point to watch in reverse proxy configuration is the proper handling of the X-Forwarded-For header. Because URL shorteners record the IP address a click comes from, the proxy needs to be configured to pass the client's real IP to the backend. MDN cautions that IP addresses in X-Forwarded-For other than those added by trusted proxies may be spoofed (as of July 2025). Tuning for high-traffic environments, such as support for HTTP/2 and HTTP/3, connection keep-alive settings, and adjustment of timeout values, also affects performance.