REVERSE PROXY CRASH COURSE
by Poot
BEFORE READING, A FEW DISCLAIMERS!
WHAT THIS DOES NOT COVER
- How to set up proxies for Janitor AI.
- Where to get free models.
WHAT THIS DOES COVER
- An oversimplified, but quick rundown on what reverse proxies are.
- The pros and cons of reverse proxies.
- How to spot and protect yourself from questionable reverse proxies.
NOTES
The purpose of this crash course is to help answer questions that anyone might have about reverse proxies, their purpose, and the dangers it can pose. This is beneficial for anyone wanting to get a basic idea of how Janitor AI's proxy configuration works!
With the growing interest in alternative AI providers and other AI models, I hope to pass on some knowledge as a Web Developer to help inform the community.
Also this is a WIP, so any feedback or questions are very much appreciated!
WHAT IS A REVERSE PROXY?
A reverse proxy is an intermediary server or service that sits between clients and web servers. It forwards a user's requests to the right server -sometimes also called a backend or origin server- and then returns the responses back to the client, all while hiding the real server.
EXAMPLE
Imagine a receptionist in a company lobby.
Many people enter inside the company building, all of which the receptionist will verify through security before directing to the right department. This way, nobody gets direct access to the building without going through the receptionist first.
WHY USE REVERSE PROXIES?
- It balances the traffic load on websites to keep them fast and reliable.
- Shields web servers from attackers, or untrustworthy sources, by concealing their real addresses.
- Caches content and handles encryption to prevent servers from overloading.
HOW DOES IT WORK?
- Client sends a request.
- The reverse proxy forwards the request to the backend/origin server.
- Origin server processes the request and then returns the response back to the reverse proxy.
- The reverse proxy sends the response back to the client.
POTENTIAL DOWNSIDES
- A faulty or compromised reverse proxy invites attackers to gain access to the internal network or manipulate traffic.
- In HTTPS websites, a reverse proxy is often the single point of security. When that fails, there's no other form of security to protect the servers.
If you're even more curious how reverse proxies can be used to inject malicious code, take a look into how attackers managed to hack lastpass, a password manager and digital vault used for storing sensitive data.
HOW DOES THIS TIE IN WITH THIRD-PARTY PROXY FOR JANITOR AI?
If you've been following this crash course, you should have an idea how reverse proxies work. Otherwise, go back to the how does it work section of the page.
When you use any provider (like Deepseek, OpenAI, Anthropic, etc.) you use their API URL (or endpoint), your API key, and model name. All of this information is borrowed outside of Janitor AI and put into the respective fields in the proxy configuration. Then, whenever you send a message to a bot using these settings, all of the relevant information gets sent to the provider itself. In turn, the provider processes the information and returns a response back to you in the form of the bot's reply to your message.
Here's a handy visual to help!
Credit to hibiki
PRECAUTIONS & SAFETY
While the internet is an awesome invention of the modern age, it goes without saying that it's important to be mindful while online. Reverse proxy by itself is NOT an illegal technology, but one of many tools used to manage a website on a network level. It's the intention and illegal activities tied to the usage of reverse proxies that creates misunderstandings that there are "legal" and "illegal" reverse proxies.
EXAMPLE
Safe Reverse Proxy
Cloudflare is a widely used by many websites and services for their security and performance. You might recognize this name whenever you sign in to Janitor AI or while chatting with a bot. These methods sound familiar, right? That's because Cloudflare is also a reverse proxy! More specifically, a reverse proxy cloud provider.
Unsafe/Illegal Reverse Proxy
If you're familiar with the term "phishing" (a form of reverse engineering scam where attackers bait users into revealing sensitive information), reverse proxy phishing takes it to a whole other level. This is the most dangerous type of reverse proxy because the phishing site uses the legitimate site as a front while gathering sensitive data from users. An example of the technique includes reverse proxy phishing with Evilginx.
You might be asking yourself, "So what are some things to look out for?" or "How can I protect myself?" There are many factors to keep in mind, but they ultimately boil down to these:
A reverse proxy's Privacy Policy and Terms of Service.
- It might be a chore to read, but the most important one to pay attention to! The part to keep in mind is their transparency in how they use your information. If it reads too vaguely or in a way that doesn't express their clear intention? It's likely not a safe source!
Availability of API keys.
- More often than not, being able to randomly generate your own API key can be a good indicator of a reputable website's credibility. However, those with nefarious intent could utilize stolen API keys or allow the creation of API key to make it easier to pinpoint their
victimsusers. - Any freely distributed API keys is a major red flag! Even if you get DMed or sweet talked into using one, DO NOT use it. Treat it as a live grenade, a spider, or whatever your phobia is.
- If it's a proxy that doesn't require any API keys to use? Run far away in the opposite direction.
Avoid or be cautious of proxies being shared publicly.
- As tempting as it is to jump onto any message that says,
Hey free <insertPopularAIModel> at <freeProxy/v1>it's always wise to err on the side of caution. Ask for more context and exhaust Google or your preferred search engine. Always do your research! If it's free or too good to be true, it probably is.
All in all, it's best to approach any reverse proxy and services with a healthy dose of skepticism. If you absolutely must test out any of them, always protect yourself using either a VPN or a Google colab! This might be going the extra mile, but if you're a more tech savvy user, you can utilize Docker or a Virtual Machine.
If you decide to reference or utilize any of the contents in this guide, it would be much appreciated for credits to be given where its due. Thank you!
DISCLAIMER
Use any third party providers at your own risk! No one is accountable for anything that may happen to you.
Also do keep in mind that many providers offer free models at a reasonable limit. Please don't abuse them!
SOURCES
- [ngrok blog post] - Reverse proxy vs. API gateway: Key differences explained
- Cloudfare as a reverse reverse proxy cloud provider
- Reverse proxy phishing with Evilginx
- Hibiki for permission to use their proxy chart and info