What is a reverse proxy?

Definition

Reverse proxy is a set of software designed to manage and distribute incoming traffic between the servers of a web resource.

​

When tens of millions from around the world visit Youtube, there is a complex of subsystems that decides from which specific server to retrieve videos a show them to each specific user. This complex is based on a reverse proxy.

According to some unofficial data, Youtube has more than 2.5 million servers in 30+ data centers on different continents. To ensure fast and reliable service, it is important to distribute incoming requests and returned streams.

Software examples

Here is a list of some popular reverse proxy software at the moment of writing this article:

• Nginx;
• Apache;
• Caddy;
• HAProxy;
• Envoy;
• Traefik.

Some of these programs were originally created with other problems and tasks in mind, so their functionality may be much broader than just reverse proxy. In particular, they can act as a web server, mail server, direct proxy, etc.

What tasks does a reverse proxy solve

Load balancing

If a web resource is located on several servers, the reverse proxy distributes incoming requests evenly between them.

Checking server health

If any server goes down temporarily, the reverse proxy "notices" this and stops sending requests to it. When the server goes up and running again, requests start coming to it automatically.

Several servers at a single URL

Using a reverse proxy creates the possibility to locate several servers or even clusters of servers at a single URL address.

Content compression

A reverse proxy can compress information for the user already on the side of the web resource.

This enables a much faster data communication. The user receives data in compressed format, and the browser unpacks it using the user device’s CPU rather than downloads the uncompressed traffic from the web.

Website acceleration (request caching)

The operation of websites is accelerated with the help of reverse proxy through caching (or remembering) the static and dynamic content sent by websites.

For example, if the reverse proxy of a video hosting service has “figured out” that a certain video is very popular among users (it is being requested by many users), it can cache that video and send it immediately in compressed form to requesting users rather than having to request it from the appropriate server and process it for sending.

Spoon feeding

Pages on most modern websites are built dynamically. This means that the user downloads information from the website’s database, and the browser reconstructs the page on the user device.

If the data communication to the user is slow, the server spends more time sending data than it could. In this situation, the commnication can be configured so that the server sends the entire package of the requested data to the user’s reverse proxy and moves on to other tasks, and the user can receive the data from the reverse proxy at a comfortable pace.

​

​

Software firewall

Protection against DDoS attacks is most typically implemented through configuring the reverse proxy to pass/block incoming traffic.

In this approach, the reverse proxy processes incoming traffic based on rules that enable it to distinguish regular users from malicious actors. One such rule is the so-called “requests limit”.

​

​

Enabling SSL/TLS traffic

If a web resource does not support operation with encrypted information, i.e. it cannot receive and send HTTPS traffic, this problem can be addressed by installing and configuring a reverse proxy.

​

​

A/B testing

This type of testing is applied to test hypotheses about user behavior when working with similar services with different implementations. Think of two landing pages with different designs.

​

​

Protection of server information

A reverse proxy, when configured appropriately, can hide the information about the servers behind it. This is an extra measure to protect the web service, so external services cannot detect the servers’ IP addresses and locations.

Summary

A reverse proxy is software, not hardware. This software is hosted on the side of the web resource and is designed to filter incoming traffic, redirect it to servers, balance their loads, expedite operation and protect the web resource from external attacks.