Bridge WAF
What is a reverse proxy?
A reverse proxy is a server that stands in front of another server and handles requests on its behalf. The client talks to the proxy and never directly to the origin, the server that holds the application. The proxy passes each request on and returns the answer. A forward proxy stands in front of clients instead.
How it works
The path of one request through a reverse proxy has four steps.
- The client sends a request to the address it knows. That address belongs to the proxy.
- The proxy receives the whole request: method, path, headers and body.
- The proxy sends a request to the origin server, either unchanged or with changes of its own.
- The origin answers the proxy, and the proxy returns the response to the client.
The client sees one server and the origin server sees one client, and in both cases that is the proxy. Because the proxy receives the request itself and opens its own connection to the origin, a proxy for web traffic works at layer 7: it reads HTTP requests, not packets. For HTTPS this means the proxy is where the encrypted connection ends, since a request cannot be read while it is still encrypted.
Reverse proxy vs forward proxy
The two differ in which side they protect from direct contact.
| Stands in front of | What the other side sees | |
|---|---|---|
| Forward proxy | clients | the server sees the proxy, not the client |
| Reverse proxy | servers | the client sees the proxy, not the origin |
A reverse proxy can be given other jobs besides forwarding. They are outside this page, which covers only the position and what follows from it.
Why it matters
The position decides what can be done with a request. Anything that must judge a request before the application sees it has to stand in the path of that request, and a reverse proxy is exactly such a place. A web application firewall can work from there: it reads each request and decides whether to pass it on or refuse it. Without that position there is no point before the origin at which a request could be refused.
The position is not the defence, though. A proxy that only forwards judges nothing, and the rules are what make it a firewall. The second limit is routing: a request that reaches the origin without passing through the proxy is not seen by it at all.
The same position can be held in the cloud or by a device in your own network. That choice is compared under cloud WAF vs appliance.
Related terms
The rest of the filtering vocabulary is in this glossary.