Reverse proxy concept in HLD - System Design Guide

Problem Statement

When clients send requests directly to backend servers, those servers can become overwhelmed by traffic spikes, exposing them to security risks and making it hard to manage load or apply centralized controls. Without an intermediary, backend servers also reveal their internal structure, increasing attack surface and complicating maintenance.

Solution

A reverse proxy sits between clients and backend servers, receiving all client requests first. It forwards requests to appropriate backend servers, handles load balancing, caches responses, and applies security rules. This setup hides backend details, distributes traffic evenly, and improves performance and security by centralizing control.

Architecture

Clients

Clients

↓

Reverse Proxy

Reverse Proxy

↓

Backend 1

This diagram shows clients sending requests to a reverse proxy, which then forwards them to one of multiple backend servers.

Trade-offs

✓ Pros

→

Improves security by hiding backend server details from clients.

→

Enables load balancing to distribute traffic evenly across servers.

→

Allows caching of responses to reduce backend load and improve latency.

→

Centralizes SSL termination and authentication for easier management.

✗ Cons

→

Introduces an additional network hop, potentially adding latency.

→

Becomes a single point of failure if not properly replicated.

→

Adds complexity to system architecture and deployment.

Use when you have multiple backend servers needing load distribution, want to improve security by hiding internal servers, or need centralized control for caching, SSL, or authentication.

Avoid when your system is very simple with a single backend server and low traffic, where the added complexity and latency of a reverse proxy outweigh benefits.

Real World Examples

Netflix

Uses reverse proxies to route user requests to appropriate streaming servers while hiding internal infrastructure and balancing load.

Amazon

Employs reverse proxies to manage traffic to backend services, enabling caching and SSL termination at the edge.

Uber

Uses reverse proxies to secure APIs and distribute requests among microservices efficiently.

Alternatives

Load Balancer

Focuses mainly on distributing traffic evenly without necessarily hiding backend details or providing caching and security features.

Use when: Choose when you only need simple traffic distribution without additional proxy features.

API Gateway

Acts as a reverse proxy but also provides API-specific features like request transformation, rate limiting, and authentication.

Use when: Choose when managing APIs with complex routing and security policies is required.

Summary

Reverse proxies protect backend servers by acting as intermediaries for client requests.

They enable load balancing, caching, and centralized security controls.

They are best used in systems with multiple backend servers or complex traffic management needs.

Practice

1. What is the primary role of a reverse proxy in a web system?

easy

A. It stores data permanently like a database.

B. It receives client requests and forwards them to backend servers.

C. It acts as a client to send requests to other servers.

D. It directly serves static files without contacting servers.

Solution

1. Step 1: Understand the role of reverse proxy

   A reverse proxy acts as an intermediary between clients and backend servers, receiving requests from clients.

2. Step 2: Identify what it does with requests

   It forwards these requests to the appropriate backend servers for processing, then returns the response to the client.

3. Final Answer:

   It receives client requests and forwards them to backend servers. -> Option B

4. Quick Check:

   Reverse proxy role = Forward requests [OK]

Hint: Reverse proxy forwards client requests to servers [OK]

Common Mistakes:

• Confusing reverse proxy with database
• Thinking reverse proxy acts as a client
• Assuming it serves files directly without servers

2. Which of the following is a correct function of a reverse proxy?

easy

A. Load balancing incoming client requests across servers.

B. Storing user session data permanently.

C. Generating dynamic web pages on the server.

D. Directly connecting clients to databases.

Solution

1. Step 1: Identify reverse proxy functions

   Reverse proxies distribute incoming client requests to multiple backend servers to balance load and improve performance.

2. Step 2: Eliminate incorrect options

   Storing session data, generating pages, or direct DB connections are not reverse proxy tasks.

3. Final Answer:

   Load balancing incoming client requests across servers. -> Option A

4. Quick Check:

   Reverse proxy function = Load balancing [OK]

Hint: Reverse proxy balances load, not stores data [OK]

Common Mistakes:

• Confusing reverse proxy with application server
• Thinking it stores session data
• Assuming it generates web pages

3. Consider a system where a reverse proxy receives 1000 requests per second and forwards them evenly to 4 backend servers. How many requests per second does each backend server receive?

medium

A. 4 requests per second

B. 4000 requests per second

C. 250 requests per second

D. 1000 requests per second

Solution

1. Step 1: Understand load distribution

   The reverse proxy evenly splits 1000 requests among 4 servers, so each gets an equal share.

2. Step 2: Calculate requests per server

   1000 requests ÷ 4 servers = 250 requests per server per second.

3. Final Answer:

   250 requests per second -> Option C

4. Quick Check:

   1000 ÷ 4 = 250 [OK]

Hint: Divide total requests by number of servers [OK]

Common Mistakes:

• Multiplying instead of dividing
• Confusing total with per server requests
• Ignoring even distribution

4. A reverse proxy is configured to cache responses but clients report stale data. What is the most likely cause?

medium

A. The cache expiration time is set too long.

B. The reverse proxy is not forwarding requests.

C. Backend servers are down.

D. Clients are bypassing the reverse proxy.

Solution

1. Step 1: Analyze caching behavior

   If clients get stale data, it means cached responses are not refreshed frequently enough.

2. Step 2: Identify cause of stale cache

   Setting cache expiration too long causes the reverse proxy to serve old data instead of fresh responses.

3. Final Answer:

   The cache expiration time is set too long. -> Option A

4. Quick Check:

   Long cache time = stale data [OK]

Hint: Check cache expiration for stale data issues [OK]

Common Mistakes:

• Assuming backend servers are down without checking
• Thinking reverse proxy stops forwarding requests
• Ignoring cache settings

5. You want to design a scalable web system using a reverse proxy that handles SSL termination, load balancing, and caching. Which of the following is the best architectural choice?

hard

A. Place the reverse proxy behind backend servers to handle load balancing.

B. Let each backend server handle SSL and caching individually without a reverse proxy.

C. Use a reverse proxy only for caching, and let clients connect directly to backend servers for SSL.

D. Use a reverse proxy in front of multiple backend servers, configure SSL termination and caching on it.

Solution

1. Step 1: Understand reverse proxy capabilities

   A reverse proxy can handle SSL termination, load balancing, and caching centrally, simplifying backend servers.

2. Step 2: Evaluate architectural options

   Placing the reverse proxy in front of backend servers allows it to manage SSL and cache efficiently, improving scalability and security.

3. Final Answer:

   Use a reverse proxy in front of multiple backend servers, configure SSL termination and caching on it. -> Option D

4. Quick Check:

   Reverse proxy front = SSL, load balance, cache [OK]

Hint: Put reverse proxy in front for SSL and load balance [OK]

Common Mistakes:

• Letting backend servers handle SSL separately
• Placing reverse proxy behind servers
• Splitting SSL and caching between clients and servers