Sitting in the flow of traffic, a reverse proxy integrates with an organization’s authentication service (e.g., single sign-on). Once IT configures services and apps to transact with the reverse proxy, the proxy can operate inline without an agent. This offers a straightforward user experience, with incoming traffic to managed cloud apps and the like redirected to the reverse proxy automatically.
Let’s look at this process a bit more closely.
A reverse proxy can protect sensitive data (e.g., PCI data, PII) by acting as a middleman or stand-in for the server on which that data resides. Client requests are routed first to the reverse proxy, then through a specified port in any applicable firewall, and then to the content server—and finally, back again. The client and the server never communicate directly, but the client interprets responses as if they had. Here are the basic steps:
- Client sends a request, which the reverse proxy intercepts
- Reverse proxy forwards the incoming request to the firewall (the reverse proxy can be configured to respond directly to requests for files in its cache without communicating with the server—see more detail on this in the use cases)
- Firewall either blocks the request or forwards it to the server
- Server sends response through the firewall to the proxy
- Reverse proxy sends the response to the client
The reverse proxy can also scrub server responses for information that could allow a hacker to redirect to protected internal resources or take advantage of other vulnerabilities.
Open Source Software and Reverse Proxies
Reverse proxies are often built on open source software (OSS) due to the fact that it allows developers to access, modify, and distribute the source code. Many open source reverse proxies offer flexible and customizable features, allowing users to tailor the proxy according to their requirements.
For example, Nginx, Apache, and HAProxy are all reverse proxies that, through their OSS functionality, provide load balancing, caching, SSL offloading, and http request routing. OSS can also be ideal for security purposes, as it allows many eyes to review the code to identify vulnerabilities and propose fixes.
