Reverse proxy: definition and meaning

A reverse proxy is a server that accepts requests on behalf of one or more backend servers, forwards them, and returns the responses. In local development, one common use is to put HTTPS in front of a plain HTTP dev server.

Updated

What it does

A reverse proxy sits in front of servers. The client talks only to the proxy. The proxy chooses a backend, forwards the request, and passes the response back. MDN lists load balancing, authentication, decryption, and caching among the reasons to use one. A forward proxy works on the client side instead: it provides proxy services to a client or a group of clients.

Local HTTPS termination

For local work, the job that matters is TLS termination. The browser connects to the proxy over HTTPS. The proxy ends the encrypted connection and sends the request on to the dev server over plain HTTP on a loopback address. The app needs no certificate code, and the certificate lives in one place.

An nginx server block for a dev server on port 3000:

nginx
server {
  listen 443 ssl;
  server_name myapp.localhost;
  ssl_certificate     /path/to/cert.pem;
  ssl_certificate_key /path/to/key.pem;

  location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
  }
}

The listen 443 ssl line turns on TLS for the socket, and the two ssl_certificate lines point at the certificate and key files. The proxy lines are the ones people forget:

  • Host $host: by default nginx replaces the Host header with the backend address from proxy_pass. $host is the host name from the client’s Host header, so the app still sees myapp.localhost. Without it, redirects and absolute links built from the Host header point at the wrong origin.
  • X-Forwarded-Proto $scheme: MDN describes this header as a de facto standard for telling a backend whether the client used HTTP or HTTPS to reach the proxy. The proxy talks plain HTTP to the app, so without it the app cannot tell. Check how your framework decides whether to trust proxy headers.
  • Upgrade and Connection: nginx’s WebSocket documentation says these hop-by-hop headers are not passed from client to backend, so you pass them explicitly. A dev server that uses a WebSocket for live reload then keeps working through the proxy.
  • proxy_http_version 1.1: WebSocket proxying needs HTTP/1.1. The nginx documentation gives 1.0 as the default for backend connections before nginx 1.29.7, so the line matters on older releases.

Two things to remember

The browser must trust the certificate, or you get a warning page. The mkcert README describes a zero-config tool for locally trusted development certificates: mkcert -install creates a local certificate authority and adds it to the system trust store. mkcert does not configure your server, so you point nginx at the files it writes. The backend also stays reachable over HTTP on its own port: the proxy adds an address and does not replace one.

In Rig

  • Rig’s local HTTPS is a TLS reverse proxy to the project’s loopback HTTP URL. It only fronts loopback upstreams.
  • The host is {slug}.rig.localhost, where the slug is the project name lowercased to [a-z0-9-] and capped at 40 characters. A project that already has a *.localhost HTTPS URL keeps it.
  • The default HTTPS port is 8443, and it cannot go below 1024.
  • The certificate comes from mkcert, which Rig installs through Homebrew on macOS, or through Scoop or winget on Windows, when it is missing. It covers the host, *.rig.localhost, localhost, 127.0.0.1, and ::1. Without mkcert, Rig falls back to a self-signed certificate made with openssl, and browsers warn about that.
  • Rig-managed WordPress sites use local HTTPS automatically.

See Local HTTPS.

Related terms

Sources

  1. NGINX documentation: NGINX reverse proxyOfficial documentation, checked 13 October 2026
  2. NGINX documentation: ngx_http_proxy_moduleOfficial documentation, checked 13 October 2026
  3. NGINX documentation: WebSocket proxyingOfficial documentation, checked 13 October 2026
  4. NGINX documentation: Configuring HTTPS serversOfficial documentation, checked 13 October 2026
  5. NGINX documentation: NGINX SSL terminationOfficial documentation, checked 13 October 2026
  6. MDN Web Docs: Proxy servers and tunnelingOfficial documentation, checked 13 October 2026
  7. MDN Web Docs: Proxy serverOfficial documentation, checked 13 October 2026
  8. MDN Web Docs: X-Forwarded-ProtoOfficial documentation, checked 13 October 2026
  9. mkcert on GitHubOfficial documentation, checked 13 October 2026

Related reading

See how Rig fits in

Rig is a Mac app that starts, stops, and watches the processes in a project from one window. The knowledge base explains each part in plain language.

Read what Rig is

Related

https://userig.app/glossary/reverse-proxy