reverse proxy

An HTTP server that accepts the client's connection itself and then makes its own request to the application behind it: proxy_pass http://127.0.0.1:3000 in an nginx location block. Two things it is not. It is not port forwarding — there is no single TCP connection from browser to Node, there are two, which is why TLS terminates at the proxy while the application speaks plain HTTP on loopback. And it is not the proxy configured in a browser: that one the client chooses, this one the domain owner chooses, and the client cannot tell it is there at all. What catches people out is the consequence: the application knows only what the proxy tells it about the visitor. Without the proxy_set_header lines, every request appears to arrive from 127.0.0.1, over HTTP, for a host it does not recognise.