A middleman that forwards requests between two parties, sitting in the path to add control, security, or convenience.
Why it exists
Sometimes traffic should not go straight from client to destination: it needs to be filtered, logged, cached, or sent on someone's behalf. A proxy exists as a stand-in that sits between and forwards requests, so that control point exists at all.
How it actually works
A proxy stands between a client and a server and passes requests along. On the client side, it can hide who's really asking or filter what's reachable. It's the general idea behind several more specific things (reverse proxies, VPNs, corporate web filters).
The value is in what the middleman can do while forwarding: cache, block, log, or reroute.
A senior PM walks you through it
A junior PM, stuck
A corporate client says their whole office gets blocked from ordering lunch on TiffinBox around 12:40 every day, and their IT team swears it is our system, not their network. Support is convinced it is the client's proxy. The dev pulled eight access-log lines to settle it and handed them to me, but I cannot tell from them who is actually right, and I am about to reply to an angry client.
These eight lines settle it, and the answer is that both sides are half right in a way you can point at. A proxy is a middleman that forwards everyone's requests, so a whole office can reach us wearing one address. The log carries both that shared address and, quietly, the real machine behind each request, which is the piece that tells you this is forty people, not one abuser. Read the source IP and the two headers on each line, then take the steps with me.
2026-03-06T12:40:02Z src=103.4.145.22 via=corporate-proxy xff=10.20.3.11 POST /api/orders 201 rl_remaining=7
2026-03-06T12:40:05Z src=103.4.145.22 via=corporate-proxy xff=10.20.3.48 POST /api/orders 201 rl_remaining=4
2026-03-06T12:40:09Z src=103.4.145.22 via=corporate-proxy xff=10.20.3.16 POST /api/orders 201 rl_remaining=1
2026-03-06T12:40:11Z src=103.4.145.22 via=corporate-proxy xff=10.20.3.52 POST /api/orders 429 retry_after=48 rl_remaining=0
2026-03-06T12:40:13Z src=103.4.145.22 via=corporate-proxy xff=10.20.3.09 POST /api/orders 429 retry_after=46
2026-03-06T12:40:15Z src=118.179.44.9 POST /api/orders 201 rl_remaining=58
2026-03-06T12:40:22Z src=103.4.145.22 via=corporate-proxy xff=10.20.3.31 POST /api/orders 429 retry_after=39
2026-03-06T12:40:40Z src=103.4.145.22 via=corporate-proxy xff=10.20.3.77 POST /api/orders 429 retry_after=21
Click a step to see the lines it points at.
Mistakes I've seen
Banning 103.4.145.22 to stop the "flood." It is a paying corporate office behind a proxy, and blocking the address blocks every employee at once, turning a rate-limit tuning problem into a lost account.
Telling the client "it is your proxy, not us." The proxy is why they share an address, but the 429s are our per-source-IP limit firing, so the fix lives on our side, not theirs.
Assuming one IP means one user. X-Forwarded-For shows seven different office machines behind this single address, so the limit is punishing forty lunch orders as if they were one person hammering us.
Speccing a rate limit as a flat number per source IP. That silently blocks any shared proxy, office, campus, or carrier NAT, and the log shows exactly that boundary being crossed at lunch.
Escalating without the Via and X-Forwarded-For evidence. "The office is getting blocked" invites a fight, while "all their orders share src 103.4.145.22 via corporate-proxy and trip our per-IP limit, with distinct xff per user" points engineering straight at the fix.
Reply to the client and the dev with: "Traced it. Every order from the office arrives as one source IP through a corporate proxy, so our per-IP rate limit counts forty employees as one user and starts returning 429 after a handful of orders. The X-Forwarded-For header shows the real distinct machines, so the fix is keying the rate limit on that behind trusted proxies, not banning the IP." You read the two proxy headers and turned a blame fight into a specific change.
Where a PM meets this
"It works for me but not on the office network" can be a corporate proxy filtering or blocking something.
The concept underpins reverse proxies and CDNs, which you'll meet as real infrastructure decisions.
Hear it in a meeting
"Requests from their corporate proxy are all showing one IP."