Reverse Proxy

A reverse proxy accepts connections from clients on behalf of one or more backend servers and forwards each request to the right backend. Clients see only the proxy's address and certificate. nginx, HAProxy, Apache httpd, Caddy, Envoy, CDNs and cloud load balancers all commonly act as reverse proxies. It is the mirror image of a forward proxy, which acts on behalf of clients reaching out to other servers.

Why it matters

Most HTTPS deployments perform TLS termination at a reverse proxy. One place holds the certificates, enforces protocol versions and HSTS, redirects HTTP to HTTPS, and lets backends speak plain HTTP on a private network. The proxy must also forward what the backend can no longer see: the original Host header, the client IP and the original scheme. If X-Forwarded-Proto is missing, many frameworks believe the request arrived over HTTP and generate http:// links or redirect loops. Typical certificate mistakes at the proxy are serving only the leaf certificate instead of the full chain and pairing a certificate with the wrong private key.

Example

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name example.com;
    ssl_certificate     /etc/ssl/example.com/fullchain.pem;
    ssl_certificate_key /etc/ssl/example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Common misconceptions

• The backend application also needs the certificate. Only the component that terminates TLS needs it, unless you re-encrypt to the backend.
• The backend sees the visitor's IP address. It sees the proxy's address unless the proxy forwards the client IP and the backend trusts that header from the proxy only.
• A reverse proxy is the same as a forward proxy. A forward proxy serves clients going out; a reverse proxy serves a site's visitors coming in.