By the end of the lesson, you can tell a forward proxy, a reverse proxy, and a CDN apart, say why intermediaries end up on the path of the request and the response, and recognize the traces of intermediaries in a real HTTP response.
Why are there intermediaries on the path?
If there were only a single wire between the browser and the application, the service would have to solve every task alone: load balancing, encryption, caching, filtering attacks, serving from a geographically close location. Intermediaries take over these tasks, or add them to the system. Their drawback is that behind a domain there is not one machine, so in debugging and in questions of responsibility you need to know how many actors are on the path.
The same course page, several actors in between
On the student's screen a single domain is visible, but the traffic may involve a client-side (for example institutional) proxy, a provider entry point, a content delivery network, and a reverse proxy. Not all of them are present in every system.
flowchart LR
B[Browser] --> P[Possible client-side proxy]
P --> C[CDN or provider entry point]
C --> R[Reverse proxy]
R --> A[Application]
The diagram shows a possible structure, not a mandatory sequence. In many cases the browser connects directly to the provider entry point. The roles of the CDN and the reverse proxy can also merge: a CDN service itself can receive and forward requests.
Forward proxy: on the client's side
A forward proxy (in everyday speech: a proxy) communicates with the remote service on behalf of the client. According to MDN it acts on behalf of clients, can hide their identity, and can store and forward traffic to reduce or control bandwidth. An organizational network can use it for access control, logging, or caching. The browser turns to the proxy, and the proxy forwards the request.
With HTTPS the proxy does not automatically read the content protected by TLS. The browser uses the CONNECT method to ask the proxy for a "tunnel" to the destination (usually on port 443), and the proxy forwards the encrypted bytes. The exact visibility depends on how the connection is built and on the organizational setup: in some organizational environments the proxy can break open the connection with its own certificate, but the machines must trust it beforehand. The mere presence of a proxy therefore does not mean that the protected message is open to every intermediary.
Reverse proxy: on the provider's side
A reverse proxy is the external entry point of the provider. According to MDN it acts on behalf of servers: its typical tasks are load balancing, caching of static content, and compression. It receives the browser's request and then directs it to an internal server, it can handle the TLS connection, and meanwhile for the browser the public domain stays the same.
For example, the path /kurzusok can go to the course application, and /dokumentumok to a file service. The reverse proxy does not fix the errors of the application running behind it: it can help only within its own task.
Intermediaries leave traces in the request so that the application knows who the original caller was. The standard Forwarded header, as well as the commonly used X-Forwarded-For (the address of the original client), X-Forwarded-Host, and X-Forwarded-Proto (the original protocol) serve this purpose. The Via header lists the intermediaries themselves. This matters because for the application the source of the connection would be the address of the reverse proxy, not that of the user; to identify the real client these headers must be taken into account. (The reliability of the headers depends on who can set them: the user can also send such a header, so only the value added by our own intermediary can be trusted.)
CDN: distributed content delivery
According to MDN's definition, a CDN is a system made up of servers placed in many geographical locations that stores copies of the same data, so that the request is served by the server closest to the user. It is often used to serve images, style sheets, program files, and other resources that are the same for many users. Its advantages: lower latency (distance counts proportionally), and less load on the origin server.
The headers of a real response from the example.com page (11 October 2026):
HTTP/2 200
server: cloudflare
age: 1950
cf-cache-status: HIT
server: cloudflare shows that the response came not directly from the origin server but from an intermediary provider.
age: 1950 is the Age header of RFC 9111: the sender's estimate of how long ago the response was generated or last validated at the origin server, in seconds (here about 32 minutes).
cf-cache-status: HIT is a provider-specific header; it indicates that the response came from the cache.
The advantage of a CDN is conditional: it depends on the cache hit, the location, the resource, and the network path. MDN also mentions three drawbacks: dependency (if the CDN goes down or is blocked in a region, the page may break), security (a compromised CDN could also serve malicious content; a remedy is, for example, Subresource Integrity), and performance (because of an external host, more connections and name resolutions may be needed).
Who actually responded?
An HTTP response can come from the application, from the cache of a reverse proxy, or from a CDN node. The browser sees the content and the status code; the internal path cannot always be determined from the visible page. So when examining a system, the intermediary layers must also be taken into account. In the next lesson we see how all this comes together into a single process.
Worked example: the entry point of Kurzuspont
Element
Task in Kurzuspont
CDN
Serving the logo, the style sheet, and the script from a node close to the student.
Reverse proxy
Terminating TLS, distributing requests among the application instances.
Application
The rules of enrolment.
Institutional proxy
Logging and filtering in the student's network.
When the student opens the course list, the style sheet most likely comes from the CDN (cache hit), while the list itself comes from the application, because it is personalized. If something does not work, the first question is: which actor gave the faulty response?
Common misconceptions
Statement
Clarification
"A proxy and a reverse proxy represent the same party."
The former stands on the client's side, the latter on the provider's side.
"With a CDN the response always comes from the cache."
On a cache miss or non-storable content the origin system must be asked.
"Behind a domain there is one server."
Intermediaries and several application instances can stand behind it.
"A reverse proxy fixes the application's errors."
It only performs its own tasks.
"A proxy always reads HTTPS traffic."
In a CONNECT tunnel the content passes through encrypted.
In brief
A forward proxy acts on behalf of the client, a reverse proxy on behalf of the server.
A CDN is a geographically distributed network of servers that store copies.
Intermediaries leave traces in headers (Via, Forwarded, Age...).
The advantage of a CDN is conditional, and it also means dependency.
The source of a response is not always the application.
Review questions
On which side does the forward proxy stand, and on which the reverse proxy?
What does the Age header show?
What is the drawback of a page depending on an external CDN?
Why does the application not see the user's real IP address behind a reverse proxy, and what can be done about it?
Proxies, reverse proxies, and CDNs
Objectives
By the end of the lesson, you can tell a forward proxy, a reverse proxy, and a CDN apart, say why intermediaries end up on the path of the request and the response, and recognize the traces of intermediaries in a real HTTP response.
Why are there intermediaries on the path?
If there were only a single wire between the browser and the application, the service would have to solve every task alone: load balancing, encryption, caching, filtering attacks, serving from a geographically close location. Intermediaries take over these tasks, or add them to the system. Their drawback is that behind a domain there is not one machine, so in debugging and in questions of responsibility you need to know how many actors are on the path.
The same course page, several actors in between
On the student's screen a single domain is visible, but the traffic may involve a client-side (for example institutional) proxy, a provider entry point, a content delivery network, and a reverse proxy. Not all of them are present in every system.
flowchart LR B[Browser] --> P[Possible client-side proxy] P --> C[CDN or provider entry point] C --> R[Reverse proxy] R --> A[Application]The diagram shows a possible structure, not a mandatory sequence. In many cases the browser connects directly to the provider entry point. The roles of the CDN and the reverse proxy can also merge: a CDN service itself can receive and forward requests.
Forward proxy: on the client's side
A forward proxy (in everyday speech: a proxy) communicates with the remote service on behalf of the client. According to MDN it acts on behalf of clients, can hide their identity, and can store and forward traffic to reduce or control bandwidth. An organizational network can use it for access control, logging, or caching. The browser turns to the proxy, and the proxy forwards the request.
With HTTPS the proxy does not automatically read the content protected by TLS. The browser uses the
CONNECTmethod to ask the proxy for a "tunnel" to the destination (usually on port 443), and the proxy forwards the encrypted bytes. The exact visibility depends on how the connection is built and on the organizational setup: in some organizational environments the proxy can break open the connection with its own certificate, but the machines must trust it beforehand. The mere presence of a proxy therefore does not mean that the protected message is open to every intermediary.Reverse proxy: on the provider's side
A reverse proxy is the external entry point of the provider. According to MDN it acts on behalf of servers: its typical tasks are load balancing, caching of static content, and compression. It receives the browser's request and then directs it to an internal server, it can handle the TLS connection, and meanwhile for the browser the public domain stays the same.
For example, the path
/kurzusokcan go to the course application, and/dokumentumokto a file service. The reverse proxy does not fix the errors of the application running behind it: it can help only within its own task.Intermediaries leave traces in the request so that the application knows who the original caller was. The standard
Forwardedheader, as well as the commonly usedX-Forwarded-For(the address of the original client),X-Forwarded-Host, andX-Forwarded-Proto(the original protocol) serve this purpose. TheViaheader lists the intermediaries themselves. This matters because for the application the source of the connection would be the address of the reverse proxy, not that of the user; to identify the real client these headers must be taken into account. (The reliability of the headers depends on who can set them: the user can also send such a header, so only the value added by our own intermediary can be trusted.)CDN: distributed content delivery
According to MDN's definition, a CDN is a system made up of servers placed in many geographical locations that stores copies of the same data, so that the request is served by the server closest to the user. It is often used to serve images, style sheets, program files, and other resources that are the same for many users. Its advantages: lower latency (distance counts proportionally), and less load on the origin server.
The headers of a real response from the
example.compage (11 October 2026):server: cloudflareshows that the response came not directly from the origin server but from an intermediary provider.age: 1950is theAgeheader of RFC 9111: the sender's estimate of how long ago the response was generated or last validated at the origin server, in seconds (here about 32 minutes).cf-cache-status: HITis a provider-specific header; it indicates that the response came from the cache.The advantage of a CDN is conditional: it depends on the cache hit, the location, the resource, and the network path. MDN also mentions three drawbacks: dependency (if the CDN goes down or is blocked in a region, the page may break), security (a compromised CDN could also serve malicious content; a remedy is, for example, Subresource Integrity), and performance (because of an external host, more connections and name resolutions may be needed).
Who actually responded?
An HTTP response can come from the application, from the cache of a reverse proxy, or from a CDN node. The browser sees the content and the status code; the internal path cannot always be determined from the visible page. So when examining a system, the intermediary layers must also be taken into account. In the next lesson we see how all this comes together into a single process.
Worked example: the entry point of Kurzuspont
When the student opens the course list, the style sheet most likely comes from the CDN (cache hit), while the list itself comes from the application, because it is personalized. If something does not work, the first question is: which actor gave the faulty response?
Common misconceptions
CONNECTtunnel the content passes through encrypted.In brief
Via,Forwarded,Age...).Review questions
Ageheader show?Learning resources
CONNECT, theForwardedheaders.