# Web proxies, origins and the WAF

> What happens between a visitor and your server when a web proxy stands in front of it, and what the edge does with each request.

Source: https://www.coritan.com/docs/learn/web-proxies/

A *proxy* takes requests in place of another server and passes them on. A *web proxy* stands in front of a website: visitors connect to Coritan's *edge*, and the edge forwards their requests to the server that runs the site, called the *origin*. The origin can be a Container Apps server, a Cloud Compute instance or a server somewhere else.

## What the edge does for a site

- It serves the site over HTTPS with a certificate for the name, and can send every `http://` visitor to `https://`.
- Its *web application firewall* (WAF) checks each request, and refuses the ones that look like attacks before they reach your origin.
- Visitors connect to the edge's addresses. A flood of requests aimed at the site's name lands on the edge, which forwards only what passes its checks, and turns away a client that sends too many requests.
- It keeps copies of images, fonts, audio and video, and answers later requests for them without asking your origin.

## How a request travels

1. A visitor opens `https://www.example.com`. DNS answers with the addresses of Coritan's edge, because the name's record is *proxied* or points at the edge.
2. The edge presents the certificate for `www.example.com`, and the browser and the edge set up an encrypted connection.
3. The edge applies the web proxy's redirects, then the WAF checks the request.
4. The edge opens its own connection to your origin, forwards the request, and passes the answer back to the visitor.

The connection your origin sees comes from the edge. The visitor's own address travels in the `X-Forwarded-For` and `X-Real-IP` headers ([What your origin receives](/docs/proxies/web-proxies/#what-your-origin-receives)).

## The WAF

The WAF compares each request with a managed set of rules that look for common attacks on websites, such as attempts to run database commands through a form. A request that matches strongly gets an error page. One that only looks suspicious gets a page that asks the visitor to confirm they are human, which scripts cannot pass. You switch the WAF on or off for each web proxy, and you cannot change its rules ([Protect a website with the WAF](/docs/websites/waf/)).

## Web proxies and DNS

A web proxy only receives traffic once its name points at the edge. When Coritan hosts the domain's DNS, a proxied `A` or `AAAA` record does this: Coritan's nameservers answer with the edge's addresses instead of your server's. When you create a web proxy for a name that has no record yet, Coritan adds the proxied record for you ([Web proxies and DNS records](/docs/proxies/web-proxies/#web-proxies-and-dns-records)).

A name has one web proxy at a time. For a game server, a *join address* does the same job for players' connections ([How join addresses work](/docs/proxies/join-addresses/)).

## Next steps

- [Put a website online](/docs/get-started/put-a-website-online/)
- [Create a web proxy](/docs/proxies/web-proxies/create-a-web-proxy/)
- [Protect a website with the WAF](/docs/websites/waf/)