Reverse Proxy Explained: Nginx, Applications and HTTPS
A reverse proxy is a server that sits between clients and your application servers, forwarding client requests to the appropriate backend. It is one of the most important components in a production web architecture, handling HTTPS termination, load balancing, caching, and security.
What Is a Reverse Proxy?
When a user visits your website, their browser connects to the reverse proxy rather than directly to your application server. The reverse proxy then forwards the request to the appropriate backend server, receives the response, and sends it back to the client.
This is different from a forward proxy, which sits on the client side and forwards outbound requests. A reverse proxy sits on the server side and handles inbound requests.
Why Use a Reverse Proxy?
HTTPS Termination
TLS/SSL certificates are configured on the reverse proxy, not on individual application servers. This means: - Certificate management is centralized in one place - Application servers can communicate with the proxy over plain HTTP (within a private network) - TLS configuration (protocols, ciphers) is managed centrally - Multiple applications can share a single certificate or use individual certificates
Load Balancing
A reverse proxy can distribute incoming requests across multiple backend servers. Common algorithms include round-robin (sequential distribution), least connections (send to the server with fewest active connections), and IP hash (consistent routing based on client IP).
Load balancing enables horizontal scaling and provides redundancy. If one backend server fails, the proxy routes traffic to healthy servers.
Security
The reverse proxy acts as a shield for your application servers: - Backend servers are not directly exposed to the internet - The proxy can filter malicious requests (SQL injection, XSS patterns) - Rate limiting prevents abuse and DDoS attacks - IP allowlisting/blocklisting at the proxy layer - Request size limits prevent resource exhaustion
Static Content Serving
Nginx is extremely efficient at serving static files (images, CSS, JavaScript). By serving static content directly from the reverse proxy, you reduce the load on application servers.
Caching
The reverse proxy can cache responses from backend servers, reducing backend load and improving response times for repeated requests.
Nginx as a Reverse Proxy
Nginx is the most widely used reverse proxy server. Here is a production-ready configuration:
server { listen 443 ssl http2; server_name app.example.com;
ssl_certificate /etc/ssl/certs/app.pem; ssl_certificate_key /etc/ssl/private/app.key;
# Security headers add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; add_header Strict-Transport-Security max-age=31536000;
# Static files location /static/ { alias /var/www/app/static/; expires 30d; }
# Application proxy location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } }
Key directives: - proxy_pass: the backend server address - proxy_set_header: passes client information to the backend - X-Real-IP: the original client IP address - X-Forwarded-For: the chain of proxy IPs - X-Forwarded-Proto: the original protocol (https)
HTTPS with Let's Encrypt
Let's Encrypt provides free TLS certificates. Certbot automates certificate issuance and renewal:
sudo certbot --nginx -d app.example.com
Certbot modifies the Nginx configuration to add SSL and creates a cron job for automatic renewal.
Reverse Proxy with Multiple Backends
upstream app_backend { server 127.0.0.1:3000; server 127.0.0.1:3001; server 127.0.0.1:3002; }
server { location / { proxy_pass http://app_backend; } }
The upstream block defines a pool of backend servers. Nginx distributes requests across them.
WebSocket Support
For applications using WebSocket connections, add these proxy headers:
location /ws/ { proxy_pass http://127.0.0.1:3000; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; }
Performance Tuning
Key Nginx performance settings: - worker_processes auto: use all available CPU cores - worker_connections 1024+: connections per worker - proxy_buffering on: buffer backend responses - gzip on: compress text responses - keepalive connections to backends: reduce connection overhead
Common Issues
- 502 Bad Gateway: backend server is not running or not reachable
- 504 Gateway Timeout: backend is responding too slowly (increase proxy_read_timeout)
- Client IP not showing in backend: verify proxy_set_header X-Real-IP is configured
- HTTPS redirect loop: ensure the backend does not also redirect HTTP to HTTPS
Conclusion
A reverse proxy is an essential component of any production web architecture. Nginx provides HTTPS termination, load balancing, security features, and static file serving in a single, high-performance package. Every production web application should sit behind a reverse proxy.