On: A Primer on Proxies

[westurner]

An HTTP reverse proxy forwards HTTP requests and adds e.g. X-Forwarded-For and X-Forwarded-Host headers.

https://www.nginx.com/resources/wiki/start/topics/examples/f... :

  X-Forwarded-For: 12.34.56.78, 23.45.67.89
  X-Real-IP: 12.34.56.78
  X-Forwarded-Host: example.com
  X-Forwarded-Proto: https

TIL from the nginx docs that there's a standardized way to forward HTTP without the X- prefix on the unregistered headers:

  Forwarded: for=12.34.56.78;host=example.com;proto=https, for=23.45.67.89

What is the difference between a reverse proxy and a load balancer?

k8s calls this "Ingress" and there are multiple "Ingress API" implementers; which essentially must reload the upstream server list on SIGHUP. https://kubernetes.io/docs/concepts/services-networking/ingr...

List of k8s Ingress Controllers: https://kubernetes.io/docs/concepts/services-networking/ingr...

[dilyevsky → westurner]

> What is the difference between a reverse proxy and a load balancer?

Reverse proxy may or may not loadbalance requests. For example, in a sidecar configuration it can just terminate tls, provide telemetry, etc and forward everything to local port.

[westurner → dilyevsky]

A [load-balancing] reverse proxy can also keep WAF rules in RAM for processing requests and responses. WAF: Web Application Firewall (OWASP CRS ruleset, CF ruleset,)

Methods for delegating HTTP requests to another application, with per-message overhead and inevitably-necessarily-tunable buffering: Layer 2 (MAC on a local segment), Layer 3 (IP), Layer 4 (TCP, UDP ports), Layer 7: HTTP parse and forward over network sockets or file sockets, defy separation of concerns and least privileges and run the (e.g. non-blocking Lua,) app within the webserver, Layer 7+: container service mesh Ingress API,

e.g. FastCGI uses file sockets, which avoids additional TCP overhead but doesn't really scale because sockets and network filesystems.

(ASGI is the Asynchronous WSGI, which specifies $ENVIRONMENT_VARIABLE names as an interface contract in order to decouple web [[reverse] proxy] servers from web applications.)

Fundamentally, which variables passed in the e.g. os.environ dict like $REMOTE_USER and IDK is it like $SSL_CLIENT_CERT_SHA384, SSL_CLIENT_CERT_*; should downstream web applications simply trust as valid strings over what network path?

TLS re-termination.

Non-root [web] servers must run on ports less than 1024, which e.g. iptables or nftables (or eBPF) can easily port-forward to only if rewriting URLs within potentially-signed assets within HTTP messages and HTTP/3 UDP streams isn't necessary.