To set up a proxy server safely, decide first which kind you need, then restrict who may use it, what it may reach and what it logs. A proxy sees every request that passes through it, so a loose configuration turns your own server into an anonymous relay for strangers or a data store you cannot defend.
What kind of proxy do you need?
The HTTP standard, RFC 9110, names three common forms of intermediary.
A proxy is a message-forwarding agent chosen by the client, usually through local configuration, to receive requests and satisfy them. The RFC notes that proxies are often used to group an organization's HTTP requests through one intermediary for security services, annotation or shared caching.
A gateway, also called a reverse proxy, acts as the origin server toward the outside while forwarding requests inward to other servers. The RFC says gateways are used to encapsulate legacy or untrusted services, to speed up servers with caching and to spread load across machines.
A tunnel is a blind relay between two connections that does not change the messages. TLS connections through a shared firewall proxy use a tunnel, opened by the CONNECT method.
Most "set up a proxy server" searches mean the first kind, a forward proxy for outbound traffic. If you really want to protect a web application, you want the second.
What are the risks?
The RFC's own security section is blunt. HTTP intermediaries are inherently situated for on-path attacks. If the system running one is compromised, or it is configured without regard to security and privacy, it can be used in a wide range of attacks. Intermediaries with a shared cache are especially vulnerable to cache poisoning. And intermediaries are no more trustworthy than the people and policies under which they operate.
Logs are the quiet risk. The RFC points out that log data gathered at an intermediary can contain a history of user agent activity across many sites, traceable to individuals. It calls that information confidential, its handling often constrained by laws and regulations, and says anonymizing entries helps but is generally not enough to prevent re-identification.
What about TLS?
Because a tunnel is a blind relay, a forward proxy with CONNECT cannot read HTTPS content. A device that does inspect it is not acting as a plain HTTP proxy. The RFC separates the proxies a client chooses from "interception proxies," which filter or redirect traffic without the client choosing them, and warns that network intermediaries like that are indistinguishable at the protocol level from an on-path attacker and often introduce security flaws or interoperability problems. If your policy requires inspection, tell users, manage the certificates deliberately and limit who can see the results.
A constructed example
A small team runs a forward proxy on a cloud server so that build machines share one outbound address. They bind it to all interfaces and skip authentication, since "it is just for us." Within days the server is carrying traffic for people they do not know, and the cloud provider's abuse team writes. The fix is two lines of intent: listen only on the private interface, and allow only the build subnet.
How to check or apply this
- Write the purpose in one sentence: outbound control, caching, or protecting an application. The type follows from that.
- Bind the listener to the narrowest interface and restrict clients by address range and by credentials.
- Allow CONNECT only to the ports you actually need, usually 443, since a tunnel will relay anything.
- Set an allowlist of destinations if the proxy exists for build or server traffic.
- Decide the log content and retention before you turn logs on, and restrict who can read them.
- Disable shared caching unless you need it, or isolate it by user group.
- Patch the proxy software on a schedule and monitor for unexpected volume.
- Test from outside your network. If you can use the proxy from a laptop on a phone hotspot, strangers can too.
Safeguard is not a proxy. Its SBOM and dependency scanning can check the proxy software you run, if it is open source, against known vulnerabilities.
Quick check
What is the difference between a proxy and a reverse proxy?
A proxy is chosen by the client to reach outside services. A reverse proxy, which RFC 9110 calls a gateway, sits in front of servers and receives requests on their behalf.
Can a forward proxy read HTTPS traffic?
Not through the standard CONNECT tunnel, which relays data blindly. Only an intermediary that deliberately intercepts TLS can, and the RFC warns such interception is hard to tell from an attack.
Sources
Last reviewed: 18 October 2026.
