VocalHyre
Sign up

Nginx · The edge of your stack

How do you configure Nginx as a reverse proxy?

Mediumreverse proxyproxy_passheadersUpdated Oct 2026
Quiz this track

Short answer

Use proxy_pass inside a location, forward the original host and client information with proxy_set_header, and use an upstream group for connection pooling and load balancing.

A reverse proxy accepts the client connection and opens a separate connection to the backend. That means Nginx must forward the information the backend needs: the original Host, client IP, protocol and any request ID.

nginx
location /api/ {
    proxy_pass http://127.0.0.1:3000/;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Request-Id $request_id;
}
The trailing slash on proxy_pass strips /api/ before forwarding; without it, the full URI is passed.

Details that matter

  • proxy_pass with a URI replaces the matched location prefix; without a URI it forwards the original URI
  • proxy_set_header replaces Nginx's default headers rather than appending
  • Set Connection to an empty value when using upstream keepalive
  • Choose connect, read and send timeouts based on backend behavior
  • Buffer responses unless the endpoint streams
Do not trust an incoming X-Forwarded-For header unless Nginx is behind a trusted proxy. Otherwise a client can spoof its address and defeat IP-based access rules.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1What is the difference between proxy_pass with and without a trailing slash?
  2. 2How does the backend learn the original client IP?
  3. 3Why would you set Connection to an empty string?
  4. 4When should proxy buffering be disabled?

Say it in the interview

I configure a location with proxy_pass to the backend and forward Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto. The trailing slash on proxy_pass matters because it controls whether the location prefix is stripped. I use an upstream block for pooling and keepalive, set timeouts deliberately and keep buffering on for normal responses. I only trust forwarded headers from a known proxy.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

MediumWhat is an upstream block and how do you tune it?MediumHow do you add and forward headers in Nginx?MediumHow do you proxy WebSocket connections through Nginx?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Nginx mock interview and get scored feedback on depth, clarity and confidence.

Start a free Nginx interviewBrowse all questions