Reverse Proxy Server¶
Software or tool — instantiates Proxy Mediation
Receives external requests on behalf of a protected backend service, presents a stable public surface, and hides the origin's location and topology from callers.
A Reverse Proxy Server represents the server side. It sits at the front door of a protected backend, receives requests from external callers on behalf of the internal service, and forwards suitable ones inward. Its defining orientation is the opposite of a forward proxy: it acts for the server being reached, not for the clients reaching in. Callers connect to the reverse proxy believing they are talking to "the service," while the real origin servers stay hidden behind it — their addresses, their number, their internal structure never exposed. The proxy is the stable public face that lets everything behind it change freely.
Example¶
A bank's public website and mobile API are fronted by a reverse proxy. A customer's app makes a request to api.bank.example; that name resolves to the reverse proxy, never to a backend server. The proxy terminates the TLS connection, checks the request is well-formed, and routes it to one of several interchangeable origin servers on a private network the customer can never see or address. The customer experiences a single, stable endpoint; the bank experiences the freedom to add, move, patch, or retire backend servers without a single client noticing.
Crucially, the origin's topology is concealed: an attacker who probes the public name learns nothing about how many servers exist or where they live, because they only ever touch the representative surface. The proxy also watches its backends — health-checking each one and quietly steering traffic away from any that stop responding. nginx and HAProxy are the canonical instances. What this proxy is not doing is governing where the bank's own employees browse outbound — that opposite direction is a different machine's concern.
How it works¶
- Own the public identity. The service's public name and certificate live on the proxy; clients only ever connect to it, never to an origin.
- Terminate and validate. It ends the client's TLS session and applies request-hygiene and trust checks before anything reaches the backend.
- Forward inward, selectively. Valid requests are routed to backend origins on a private network, chosen by rule and by which backends are currently healthy.
- Conceal the origin. Backend addresses, counts, and internal structure never appear in responses; the caller sees only the representative surface.
Tuning parameters¶
- Origin concealment depth — pass through some origin headers, or strip everything so the backend is fully opaque. More concealment protects the topology; some diagnostics need a little leak.
- Trust checks at the edge — bare forwarding versus request validation, rate limiting, and WAF-style filtering. More checks stop more abuse and add latency and false positives.
- Health-check aggressiveness — how fast an unresponsive backend is pulled from rotation. Aggressive checks fail over quickly but can evict a briefly-slow origin unnecessarily.
- Caching at the edge — whether the proxy also serves stored responses. Turning this up shades toward a dedicated caching service and reintroduces freshness concerns.
When it helps, and when it misleads¶
A reverse proxy helps whenever a service needs a stable, defensible public surface while its internals stay free to change — enabling load distribution, TLS offload, and origin concealment from one place. Clients coupling to the proxy rather than the servers is what makes the backend evolvable.
Its dangerous failure mode is the confused deputy: because the proxy holds privileged reach into the private network, an attacker who tricks it into forwarding a crafted request can make it act as their agent against the very backend it protects (request smuggling and server-side request forgery are this pattern).[1] A reverse proxy is also a concentrated choke point and a rich target — compromise it and every backend behind it is reachable. The guarding discipline is to validate and normalize requests strictly at the edge, keep the proxy's own inward privileges minimal, and never treat "it came through the proxy" as proof a request is safe.
How it implements the components¶
representation_interface— the proxy is the stable public surface (name, certificate, endpoint) through which all callers interact with the service.exposure_boundary— origin addresses, server counts, and internal topology are kept hidden behind it, so callers see only the representative.trust_policy— TLS termination plus request validation and rate limiting establish what inbound traffic is allowed to reach the backend.proxy_health_signal— continuous health checks of the origins let the proxy route around failing backends and report the service's own liveness.
A reverse proxy does not decide or record where a population of internal clients may go on the outside — delegation_rule, authority_scope over outbound destinations — that client-governing role belongs to its nearest twin, Forward Proxy Server, which represents the requesters rather than the server.
Related¶
- Instantiates: Proxy Mediation — the server-side, inbound-facing form of the archetype.
- Sibling mechanisms: Forward Proxy Server · Cached Representation Service · Privacy Relay or Anonymizing Proxy · Service Account or Bot Delegate · Broker Intermediary · Escrow Service · Human Agent or Representative · Guardian or Delegate Role
Editorial Notes¶
Form Classification¶
Form family: Control, Automation & Runtime
Rationale: Reverse Proxy Server operates by terminates live connections, validates requests, routes them to origins, and mediates responses at runtime. That concrete deployed or enacted form is Control, Automation & Runtime under the frozen taxonomy.
Nearest alternative: Structure, Architecture & Configuration — Although Structure, Architecture & Configuration can support this mechanism, the frozen evidence makes its operative form the act that terminates live connections, validates requests, routes them to origins, and mediates responses at runtime; the alternative is therefore secondary rather than defining.
Review outcome: Adjudicated after independent review; high confidence.
Origin Attribution¶
Primary origin: Computer Science & Software Engineering
Origin pattern: Single lineage
Present-day reach: Specialized
Rationale: Reverse proxy servers are established web and network-infrastructure mechanisms.
Related originating lineages:
- Engineering & Design — Engineering design, reliability, and systems-safety practice supplies a parallel or contributing lineage for the mechanism's defining operation: receives external requests on behalf of a protected backend service, presents a stable public surface, and hides the origin's location and topology from callers.
Review resolution: Both blind reviewers agree that computer_science is the primary historical origin. Explicit reconciliation of alternate origin disagreement starts from reviewer_a’s mechanism-specific evidence: Reverse proxy servers are established web and network-infrastructure mechanisms. Reviewer A proposed alternates=none, origin_mode=single_lineage, domain_reach=specialized, and encyclopedia_synthesis=false; reviewer B proposed alternates=engineering_design, origin_mode=single_lineage, domain_reach=specialized, and encyclopedia_synthesis=false. The final record retains every independently supported alternate from either review (engineering_design) without an arbitrary cap, selects origin_mode=single_lineage to represent the combined lineage evidence, and keeps domain_reach=specialized and encyclopedia_synthesis=false from the more mechanism-specific assessment. Present-day transfer is recorded as reach and is not treated as proof of historical origin.
Review outcome: Reconciled after independent review; high confidence.
References¶
[1] The confused deputy problem, named by Norm Hardy (1988), is when a program with legitimate authority is tricked by a less-privileged caller into misusing that authority on the caller's behalf. A reverse proxy is a natural deputy: it holds privileged reach into the protected network, so any flaw that lets an outsider steer what it forwards turns its trust into the attacker's weapon. withdrawn registry ↩