Proxy server

In computer networking, a proxy server is a server application that acts as an intermediary.

Instead of a client connecting directly to a destination server, the client sends a request to the proxy. The proxy then evaluates that request and performs the necessary network transactions. This setup can simplify complex requests or provide benefits like privacy and security. Proxies were originally devised to add structure and encapsulation to distributed systems. They function on behalf of the client when requesting services from a resource server.

There are two primary directions for proxy traffic: forward and reverse. A forward proxy is Internet-facing and is used to retrieve data from various sources across the web.

It routes traffic between clients and external systems. This allows the proxy to regulate traffic based on preset policies. It can also mask client IP addresses or enforce specific security protocols. In contrast, a reverse proxy is an internal-facing tool used to protect a private network.

It acts as a front-end to control and protect access to internal web servers.

Forward proxies can be categorized by how they handle user identity. An open proxy is a forwarding proxy accessible to any Internet user. In 2008, security expert Gordon Lyon estimated there were hundreds of thousands of these operating online. An anonymous proxy identifies itself as a proxy but hides the client's originating IP address. This provides a layer of privacy for the user. Conversely, a transparent proxy identifies itself and even reveals the originating IP address using HTTP header fields like X-Forwarded-For. The main advantage of a transparent proxy is its ability to cache websites for faster retrieval.

Reverse proxies serve several technical functions to improve server performance and safety. One major use is load balancing, where the proxy distributes incoming requests across several different web servers. This prevents a single server from becoming overwhelmed. Reverse proxies also provide SSL acceleration for secure websites. They can handle the heavy work of encryption, which removes the need for every individual host to have its own separate SSL server certificate. Additionally, they can cache static content, such as pictures, to offload work from the main web servers. They can even use a process called "spoon feeding" to slowly send content to slow clients, which reduces resource usage on the web servers.

Security is a central reason for using proxy technology. A reverse proxy acts as an additional layer of defense against certain OS and web-server-specific attacks. It can also be used for extranet publishing, allowing controlled access to an organization's internal functions through a firewall. However, a reverse proxy does not protect against attacks targeting the web application or service itself. On the client side, content-filtering proxies are often used by schools and workplaces.

These proxies ensure that Internet usage follows an acceptable use policy by blocking certain categories of websites. They use blacklists to filter content based on URLs, keywords, or even specific file types like JPEGs.

Filtering technology can be quite advanced and works in both directions. Some proxies scan outbound content to prevent data loss or to search for malicious software. They can also perform real-time scanning of incoming content to protect against viruses. When dealing with encrypted data, proxies generally cannot see inside SSL/TLS transactions. However, in managed workplace settings, a device might be configured to trust a specific root certificate owned by the proxy. This allows the proxy to analyze the contents of the encrypted transaction, a process similar to a man-in-the-middle attack.

While proxies offer many benefits, they can also be used to circumvent restrictions. Users may use web proxies to bypass government censorship or school filters. They might also use a proxy in a specific country to access services that use IP-based geolocation. However, using a proxy can introduce significant risks. Because all data passes through the intermediary, a proxy operator can capture and analyze everything, including passwords and cookies. For this reason, sensitive information should always be exchanged over a cryptographically secured connection like SSL to prevent eavesdropping.