In HTTP terminology it acts as an origin server on the client-facing connection while translating the request for inbound delivery. Clients normally address the reverse proxy rather than selecting it as a general-purpose relay.
Reverse proxies commonly perform TLS termination, request routing, load distribution, caching, authentication integration, rate limiting, and controlled publication of internal services. Correct design also restricts direct backend access and defines which proxy-added headers an application may trust. The proxy’s public name, certificates, health checks, and failure behavior become part of the service architecture.
Key points
Routing and isolationRoute only expected hosts, paths, methods, and protocols. Place backends on controlled networks and prevent internet clients from bypassing the proxy to reach an origin directly.
Identity and metadataRemove untrusted forwarding headers before adding authoritative values. Applications should trust them only from designated proxy addresses and should preserve auditable client attribution.
Availability and privacyUse bounded timeouts, request-size limits, health checks, capacity controls, and resilient instances. Minimize logs and protect session tokens, authorization headers, and decrypted content.
Important limitationA reverse proxy does not automatically make an application secure and is not synonymous with a web application firewall. Unsafe application logic, permissive routes, origin bypass, header confusion, or proxy compromise can still expose the service. TLS termination also leaves the proxy handling plaintext and may require protected re-encryption to backends.