In this article
Before you start
This page is part of the distributed systems interview questions material, and it assumes only the three ideas below.
Why interviewers ask this
A system design diagram often puts a box between users and servers, and the interviewer's next question is what that box is and what it costs. The proxy question tests whether a candidate can name the box's job, say which side it works for, and state its price.
A weak answer says "a proxy hides your IP." That is true of one kind of proxy and silent about the rest. A strong answer separates forward from reverse proxies, names two or three jobs (load balancing, caching, decryption), and says what the server sees. A Staff-level answer adds the failure modes: an extra hop, a single point of failure, and a client-address header that anyone can forge.
Proxy server from first principles
- Proxy server
- A proxy server is an intermediary program that receives a request from one machine, forwards it to another, and passes the reply back, so the two ends never talk directly. It sits anywhere between the user's computer and the destination server, including on the user's own computer.
- Forward proxy
- A forward proxy is a proxy that acts on behalf of clients: the client sends its requests to it, and it contacts servers for them. It can store and forward web pages to control bandwidth, and it can hide who the client is.
- Reverse proxy
- A reverse proxy is a proxy that acts on behalf of servers: clients talk to it as if it were the server, and it passes requests on to the real servers behind it. It is commonly used for load balancing, caching and compression, and it can also decrypt traffic. The HTTP standard, Request for Comments (RFC) 9110, calls such a proxy a gateway.
In plain words
Picture a company mail room. Staff hand every outgoing letter to the mail room, and it posts the letter for them. Incoming letters also arrive at the mail room, which carries them to the right desk. The mail room is a proxy. The outgoing side is a forward proxy. The incoming side is a reverse proxy.
The analogy breaks in one place. A mail room reads only the envelope, but a web proxy can read and change the whole request, and it can keep a copy of the reply for the next person who asks.
In one precise sentence, a proxy is a program that is both a server to the machine in front of it and a client to the machine behind it. The HTTP standard, Request for Comments (RFC) 9110 (June 2022), has a section named Intermediaries that treats proxies as part of the protocol's design; it uses the word "gateway" for what this page calls a reverse proxy.
Step 1: A forward proxy forwards requests for clients
A forward proxy takes a client's request, sends it to the destination server, and returns the answer. The Mozilla Developer Network (MDN) proxy guide says a forward proxy stores and forwards Internet services, such as the Domain Name System (DNS) or web pages, to reduce and control the bandwidth a group of users consumes. It adds that forward proxies can be anonymous and let users hide their IP address, and it gives Tor as an example that routes traffic through several proxies. A transparent proxy is a forward proxy that intercepts traffic without the client being set up to use it.
Input: a request from a client. Output: the same request, now sent from the proxy's address. Anonymity is an option, not a default: a proxy that does not remove identifying details does not make anyone anonymous. You now know the first role, so the next step asks what the server can still learn about the client.
Step 2: The server sees the proxy's address, so the client's address travels in a header
Because the proxy opens the connection to the server, the server sees the proxy's address, not the client's. MDN notes that the original address is often needed for debugging, statistics and location-dependent content.
The fix is a header, a labelled line added to the request. Forwarded is the standard one (RFC 7239, June 2014), and X-Forwarded-For is the de-facto (widely used, never formally standardized) header that lists the originating addresses of a client reaching a server through a proxy or load balancer.
A client controls the headers it sends, so it can forge X-Forwarded-For. In an illustrative case, a client at 203.0.113.7 sends a forged entry 198.51.100.99, and the proxy appends the real address, giving "198.51.100.99, 203.0.113.7". A server that trusts one proxy takes the last entry, 203.0.113.7, and a server that takes the first entry is fooled. With two trusted proxies in a row, it takes the second entry from the end.1 The rule: trust only entries written by proxies you run.
Step 3: A reverse proxy works for the servers
A reverse proxy stands in front of servers and receives the client's requests as if it were the site. MDN lists load balancing, caching static content such as pictures, and compression among its uses. Reverse proxies also commonly decrypt Transport Layer Security (TLS) so the servers behind them receive plain HTTP (NGINX (web server and reverse proxy) documentation on terminating encrypted traffic, read October 2026). A load balancer is a proxy that spreads incoming requests across several servers so that no single server takes all the load. TLS is the protocol that encrypts web traffic. TLS termination is the practice of decrypting that traffic at the proxy, so the servers behind it receive plain requests.
| Question | Forward proxy | Reverse proxy |
|---|---|---|
| Acts for | Clients | Servers |
| Typical jobs | Store and forward pages, control bandwidth | Load balancing, caching, compression, TLS termination |
| Whose identity it can hide | The client's | The server's |
Input: a request addressed to the site. Output: the same request, sent to one chosen server. The distributed rate limiter design sits at exactly this reverse-proxy position, in front of an API.
Step 4: A cache lets the proxy answer repeat requests itself
A cache is a store of earlier replies that lets a proxy answer a repeat request without asking the origin server (the server that holds the original). MDN lists caching static content, such as pictures, as a reverse proxy job. A proxy cache pays off when many requests ask for the same thing.
Take an illustrative model. Every request pays a proxy hop of 5 milliseconds, and each cache miss adds 120 milliseconds at the origin. With 1,000 requests per second and no caching, origin load is 1,000 per second and average latency is 125 milliseconds. At a hit rate of 80%, origin load falls to 200 per second and the average falls to 29 milliseconds. At 95%, the origin sees 50 requests per second and the average is 11 milliseconds.1
The gain depends on the hit rate, so measure it before promising it. Averages also hide the slowest requests, so check tail latency too. The distributed cache design shows how to spread such a cache over many machines.
Step-by-step description
- The proxy sends the request on from its own address.
- A header carries the client address.
- A second server shares the load.
- Repeat requests are answered by the proxy.
- A proxy forwards a request from a client to a server.
- The proxy adds a forwarded header carrying the client address.
- A reverse proxy can spread requests over several servers.
- A cache lets the proxy answer repeat requests itself.
Text description of the diagram
- Average latency is 125 milliseconds with no caching and 11 milliseconds at a hit rate of 95%.
- At a hit rate of 80% the average latency is 29 milliseconds.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →The Staff-level answer
What is a proxy server?
A proxy server is an intermediary that takes a request, forwards it on, and returns the reply. A forward proxy acts for clients, for example to control bandwidth. A reverse proxy acts for servers: load balancing, caching, and TLS termination. The server then sees the proxy's address, so I pass the client address in a forwarded header and trust only the entry my own proxy wrote. The costs are one extra hop and a single point of failure, so I run several proxies behind one address and measure the cache hit rate before counting on it.
What makes it Staff-level: it names which side the proxy serves, answers the address follow-up before it is asked, and states the cost and the mitigation.
The rubric
| Dimension | Weak answer | Strong answer | Staff answer |
|---|---|---|---|
| Correctness | "It hides your IP." | Defines the proxy as an intermediary and names both kinds. | Adds that anonymity is optional and not the default. |
| Depth | Names no jobs. | Names load balancing, caching and decryption. | Explains what the server sees and how headers carry the client address. |
| Trade-offs | None. | Mentions the extra hop. | Adds the single point of failure, and the forged-header risk. |
| Communication | Rambles through acronyms. | Defines the term before using it. | Gives definition, jobs, cost, and mitigation in that order. |
Three variants of this question
Is a load balancer a proxy?
A load balancer that receives requests and passes them to one of several servers is acting as a reverse proxy; MDN lists load balancing among reverse proxy uses. Transport-layer (layer 4) load balancers forward Transmission Control Protocol (TCP) connections without reading HTTP, so say which level you mean.
How does Hypertext Transfer Protocol Secure (HTTPS) work through a proxy?
The client sends a request using the HTTP tunnel-opening method called Connect (CONNECT), which asks the proxy to open a two-way tunnel (a path that carries traffic through without reading it) to the destination. The MDN proxy guide says this is how a client behind an HTTP proxy reaches secure sites on port 443, and that some proxies do not support this method or limit it to that port. RFC 9110 §9.3.6 defines the method.
How do you stop a proxy from being a single point of failure?
Run more than one proxy instance behind a shared address and let a health check remove a failed one. The proxy is then as available as the group, though each instance still adds a hop.
Common mistakes
- "A proxy is for hiding your IP address." (wrong) That describes one use of a forward proxy. (right) "A proxy forwards requests for one side; hiding identity is an optional use."
- "A forward and a reverse proxy are different technologies." (wrong) Both are proxies. (right) "They differ in which side they act for."
- "The server sees the real client address." (wrong) The server sees the proxy's address. (right) "The proxy passes the client address in a header such as
X-Forwarded-For." - "I take the first entry of
X-Forwarded-For." (wrong) A client can forge it. (right) "I take the entry written by the last proxy I trust." - "A cache always cuts latency." (wrong) The gain scales with the hit rate. (right) "I measure the hit rate, then estimate the saving."
Follow-up questions
Which header tells a server the original protocol, HTTP or HTTPS?
X-Forwarded-Proto identifies the protocol the client used to connect to the proxy or load balancer, per the MDN X-Forwarded-Proto reference. It matters when the proxy terminates TLS and passes plain HTTP behind it.
What does the Via header do?
Via describes the proxy itself, not the client. The MDN Via reference says both forward and reverse proxies add it, and it can appear in request and response headers. RFC 9110 has a section for it.
What is a Proxy Auto-Configuration (PAC) file?
A Proxy Auto-Configuration (PAC) file is a JavaScript function that decides whether a browser request goes directly to its destination or through a proxy server, according to the MDN PAC file guide. It lives in a file with a .pac extension.
What is the difference between a proxy server and a VPN?
A proxy forwards one application's traffic, for example HTTP, at the application level. A virtual private network (VPN) encrypts and tunnels, and can carry all of a device's Internet Protocol (IP) traffic at the network layer; NIST Special Publication (SP) 800-77 Rev. 1 (June 2020) is the guide to one common kind, the IPsec VPN. A proxy alone does not encrypt the traffic it carries unless the connection itself is encrypted.
What if the cache hit rate drops?
Origin load and latency rise together. In the illustrative model, a fall from an 80% hit rate to 50% lifts origin load from 200 to 500 requests per second and the average latency from 29 to 65 milliseconds.1 Size the origin for the lower rate.
How do you size the cache in a proxy?
Estimate the number of distinct items, their size and the share of requests the hottest ones attract, as in back-of-the-envelope estimation. The backend interview questions page covers neighbouring topics.
- A proxy server is an intermediary that forwards requests and replies between two machines.
- A forward proxy acts for clients, and a reverse proxy acts for servers.
- The server sees the proxy's address, so the client address travels in a forwarded header.
- Trust only the header entries written by proxies you run, because clients can forge the rest.
- A proxy adds a hop and a single point of failure; a cache pays off only at a measured hit rate.
Sources
- Proxy servers and tunneling - HTTP | MDN — MDN Web Docs (Mozilla contributors); accessed 2026-10-26, 9 Nov 2025
- RFC 9110: HTTP Semantics — IETF / RFC Editor (Fielding, Nottingham, Reschke); accessed 2026-10-26, 1 Jun 2022
- RFC 7239: Forwarded HTTP Extension — IETF / RFC Editor (Petersson, Nilsson), 1 Jun 2014
- Terminating SSL/TLS traffic for HTTP - NGINX documentation — NGINX documentation; read October 2026, 26 Oct 2026
- X-Forwarded-For header - MDN — MDN Web Docs; accessed 2026-10-26, 26 Oct 2026
- X-Forwarded-Proto header - MDN — MDN Web Docs; accessed 2026-10-26, 26 Oct 2026
- Via header - MDN — MDN Web Docs; accessed 2026-10-26, 4 Jul 2025
- Proxy Auto-Configuration (PAC) file - MDN — MDN Web Docs; accessed 2026-10-26, 26 Oct 2026
- NIST SP 800-77 Rev. 1: Guide to IPsec VPNs — NIST (National Institute of Standards and Technology), 1 Jun 2020
