What is a reverse proxy? Core com­pon­ents in security ar­chi­tec­ture

Reverse proxies are used as an in­ter­me­di­ary network component to secure servers of public online services. They accept server requests on behalf of the servers and forward them to the users.

How does a reverse proxy work?

Es­sen­tially, a proxy server functions as a com­mu­nic­a­tion in­ter­me­di­ary in the network, receiving requests and passing them along to a target server on behalf of the client. A reverse proxy is po­si­tioned between clients (e.g., web browsers) and backend servers (e.g., web servers, database servers, or ap­plic­a­tions). It activates when a client request is made, de­term­in­ing whether and to which internal server component the request should be directed. The process follows these four basic steps:

1. Receiving the client request: The reverse proxy accepts HTTP, HTTPS, or other requests like FTP or WebSocket.

2. Analysing the request: The proxy examines whether the request is valid, whether it presents any security risks, and if there is a cached version available.

3. For­ward­ing to the ap­pro­pri­ate server: If the request cannot be answered from the cache, the reverse proxy sends the request to one of the internal servers.

4. Response to the client: The reverse proxy receives the response from the backend server, processes it further if necessary (e.g., en­cryp­tion), and sends it back to the re­quest­ing client.

Close

What is the dif­fer­ence compared to forward proxies?

While reverse proxies, as mentioned earlier, are placed between clients and backend servers, forward proxies are po­si­tioned between clients and the internet. A forward proxy channels all client requests and forwards them with its own sender address to the target servers on the internet. Server responses also reach the proxy first before being dis­trib­uted to the re­spect­ive client devices. These remain anonymous—unless it is a trans­par­ent proxy. While a forward proxy protects clients in the internal network from external threats, a reverse proxy secures servers in a public network and optimises their ac­cess­ib­il­ity.

While reverse proxies offer clear ad­vant­ages for server struc­tures through features like load balancing and various security functions, the strengths of forward proxies lie in client pro­tec­tion.

Close

Areas of ap­plic­a­tion for reverse proxies

Bundling client requests allows reverse proxies to highly control incoming traffic. Among other things, this makes it possible to provide multiple servers under the same URL, evenly dis­trib­ute requests across different servers, and speed up data retrieval through caching. Below are the key areas of ap­plic­a­tion for a reverse proxy server.

Load balancing

A reverse proxy placed in front allows a URL to be linked with various servers in the private network. This dis­trib­utes incoming requests across multiple servers. Such load balancing prevents overload of in­di­vidu­al systems and com­pensates during failures. If a server is un­reach­able due to hardware or software errors, the proxy’s load balancing module re­dis­trib­utes incoming requests to remaining servers. This ensures the avail­ab­il­ity of server services even during failures.

Caching

To speed up server services, reverse proxies can offer a feature that allows fre­quently requested content to be cached. This caching enables the proxy server to answer re­pet­it­ive requests either partially or com­pletely on its own. Static content like images or CSS stylesheets are stored in the proxy’s cache. As a result, little to no data needs to be retrieved from the backend server, sig­ni­fic­antly ac­cel­er­at­ing the access rate to web services. However, because rapidly changing content may not always ensure the proxy’s cache has the current version, there’s a risk of de­liv­er­ing outdated in­form­a­tion to re­quest­ing clients.

Pro­tec­tion and security measures

A reverse proxy acts as a kind of shield for the backend servers and can offer various security functions in this role:

• DDoS pro­tec­tion: Reverse proxies can detect and block sus­pi­cious or unusually high traffic during DDoS attacks before it reaches the backend servers.
• Web Ap­plic­a­tion Firewall (WAF): Many reverse proxies include a WAF that can filter malicious requests like SQL in­jec­tions or Cross-Site Scripting (XSS).
• IP whitel­ist­ing and black­list­ing: The reverse proxy can block certain IP addresses or allow con­nec­tions only from specific networks if needed.
• Hiding of backend servers: The reverse proxy prevents the internal IP addresses of the backend servers from being publicly visible, making attacks more difficult.

En­cryp­tion

To reduce the load on backend servers, reverse proxy servers can also be used for en­cryp­tion. In this case, it decrypts the client’s SSL/TLS request (e.g., an HTTPS con­nec­tion), forwards the decrypted data to the backend servers, and sends the cor­res­pond­ing response back to the client encrypted again. The internal com­mu­nic­a­tion can occur either encrypted or un­en­cryp­ted.

An­onymisa­tion

A reverse proxy can also be used to anonymise traffic by masking the clients’ original IP addresses or replacing them with its own IP addresses. This helps protect the clients’ privacy, as the actual IP addresses won’t be visible in the logs. Ad­di­tion­ally, this enables geo-load balancing: requests can be routed to the nearest server depending on the geo­graph­ic location of the user.

Com­pres­sion

With the right software, a reverse proxy can be used to compress incoming and outgoing data. A popular program for com­press­ing websites is gzip, often used in com­bin­a­tion with the web servers Apache or NGINX.