Proxies

The servers in the middle of almost every request: forward and reverse proxies, layer 4 and layer 7, TLS termination, connection pooling, forwarded client addresses, caching, tunnels and sidecars.

Overview

A proxy is a server that sits in the middle of a conversation and speaks for one side of it. The client talks to the proxy; the proxy talks to the other end. Because every request passes through it, a proxy is a natural place to do work that should not be repeated in every application: encryption, routing, caching, access control and measurement.

A forward proxy speaks for clients. A company sends its staff's web traffic out through one, to filter and log it. A reverse proxy speaks for servers. Clients connect to it as if it were the service, and it passes their requests to servers that stay private behind it. Load balancers, CDN edges, API gateways and service-mesh sidecars are all reverse proxies with a particular job, so an ordinary web request may pass through five or six of them.

Interviewers use proxies to test whether you understand what each box in a diagram actually does, what it can see (only IP addresses and ports, or the whole HTTP request), and what it costs: a little latency per hop, and one more thing that must not fail.

What you will be able to do

  • Tell forward and reverse proxies apart, and name the reverse proxies in a design.
  • Choose between a layer 4 and a layer 7 proxy, and say what each can and cannot do.
  • Decide where TLS ends, and whether to encrypt again behind the proxy.
  • Recover the real client address through a chain of proxies without trusting forged headers.
  • Explain what a sidecar does in a service mesh, and choose between NGINX, HAProxy and Envoy.

Key concepts

  • Forward proxy
  • Reverse proxy
  • Layer 4 and layer 7
  • TLS termination and passthrough
  • Connection pooling
  • X-Forwarded-For and PROXY protocol
  • Caching proxy
  • CONNECT tunnels
  • Sidecars and service mesh
  • NGINX, HAProxy, Envoy

Interview questions

  • What is the difference between a forward proxy and a reverse proxy?
  • When would you use a layer 4 proxy instead of a layer 7 one?
  • Where should TLS be terminated?
  • How does a server behind proxies find the real client IP address?
  • Why put a reverse proxy in front of an application server at all?
  • What does a sidecar proxy do in a service mesh, and when is a mesh worth it?
  • How does HTTPS work through a corporate forward proxy?
  • Your only NGINX proxy is a single point of failure. How do you fix it?

Sign up free to read the full topic

More System Design topics

Start free on Cariara · Coding problems · System design studio