Cross-origin failures are one of those frontend problems that look simple until they're not. A browser refuses to load a script, an image, or an XHR response because the server doesn't send the right CORS headers. Mixed-content warnings escalate quickly when an HTTPS page tries to pull HTTP resources. The usual quick fixes are fragile, and they don't travel well across environments.
I built Proxipy, a FastAPI-based proxy that sits in front of those external resources and rewrites the traffic so the browser is happy. I designed it to be production-ready, not just a development hack. That means load balancing, rate limiting, health checks, and security controls you can actually operate.
What problem does Proxipy solve?
The core problem is origin enforcement. Browsers enforce the same-origin policy, which means a page on https://app.example.com cannot fetch https://api.other.com unless that server explicitly allows it with CORS headers. If you don't control the remote server, you're stuck.
The traditional answer is a reverse proxy or nginx rule. That works for HTML, but it becomes painful for APIs, WebSockets, binary downloads, and streaming responses. Proxipy was built to handle all of those without a pile of bespoke nginx config.
The second problem is mixed content. An HTTPS page loading HTTP resources triggers browser warnings and hard blocks in modern browsers. A proxy can serve those resources over HTTPS to the browser while fetching them over HTTP upstream.
The third problem is operational control. A proxy in production needs health checks, metrics, rate limiting, and the ability to fail over without taking down clients. Proxipy treats those as first-class features, not afterthoughts.
How is Proxipy architected?
Proxipy is built on FastAPI. The main application exposes proxy endpoints, a health endpoint, metrics, and stats. The proxy logic itself is split across configurable modules: security, rate limiting, load balancing, middleware, protocol handling, and request utilities.
YAML configuration drives most behavior. Server settings, backend lists, security policies, rate limits, middleware priorities, and load-balancer algorithms are all declarative. That makes environment-specific overrides straightforward, and the hot-reload support means you can tune without a full restart.
Intelligent streaming is one of the more practical design choices. Large files and binary content are streamed rather than buffered entirely in memory. Content-type detection decides whether to stream or buffer based on size and payload type, which keeps memory usage predictable under load.
What load balancing strategies are available?
Proxipy includes a full load-balancing layer with multiple algorithms. Round-robin distributes evenly across healthy backends. Weighted round-robin lets you bias traffic toward larger or faster instances. Least connections routes to the backend with the fewest active requests. Least response time prefers the fastest backend.
Source IP hash, URI hash, and header hash give you session stickiness without sticky cookies. Random is available when you want simple distribution with no state.
Health checks run automatically. TCP checks confirm reachability. HTTP and HTTPS health checks validate status codes. Failure thresholds control when a backend is marked unhealthy, and successful checks bring it back without manual intervention.
Session persistence is optional and configurable. Cookie-based stickiness is the most common. IP-based affinity is available when you can't rely on cookies. Both have configurable timeouts.
What security controls are included?
Rate limiting is per-client IP, with configurable per-minute and per-hour limits. It supports Redis-backed storage for distributed deployments and falls back to in-memory counters when Redis isn't available.
Request validation sanitizes URLs and headers before they hit the backend. Suspicious-pattern detection blocks directory traversal, injection attempts, and known bad payloads. Private IP protection prevents access to RFC 1918 ranges unless explicitly allowed.
Blocked hosts and domains are configurable. HTTPS-only mode rejects cleartext upstream requests when you need strict transport enforcement. Security headers including CSP, HSTS, and XSS protection can be injected automatically.
CORP, COEP, and COOP headers are available for cross-origin isolation when you need SharedArrayBuffer or stronger fetch semantics.
How do you monitor Proxipy in production?
Proxipy exposes three observability endpoints. /health returns status, timestamp, version, load-balancer state, middleware count, and metrics summaries. /metrics gives performance counters including total requests, errors by type, average response time, active connections, and uptime.
/stats returns HAProxy-style backend statistics: frontend request totals, backend server health, current connections, weights, response times, and consecutive success or failure counts. That format is intentionally familiar because it integrates with existing monitoring dashboards and alerting rules without custom parsers.
Structured logging supports JSON and text formats with configurable levels. Request and response logging captures method, URL, status, timing, and client identity for audit trails.
How do you deploy Proxipy?
The quickest path is Docker Compose. A single command starts the proxy with optional Redis for rate limiting. The Docker image includes the Python runtime, dependencies, and a default config. Environment variables override YAML settings, so secrets and per-environment tuning stay outside the image.
For manual deployment, create a virtual environment, install requirements, and run python -m app.main. The config-localhost.yaml file is a sane default for local development. In production, set debug=false, attach a reverse proxy for TLS termination, and configure Redis for distributed rate limiting.
Nginx, Caddy, or Cloudflare can terminate TLS in front of Proxipy. The proxy itself doesn't need to handle certificates unless you want end-to-end encryption to backends.
FAQ
What is Proxipy?
Proxipy is a production-ready CORS proxy server built with FastAPI that bypasses same-origin policy and mixed-content issues, with intelligent streaming, load balancing, rate limiting, and comprehensive security middleware.
Does Proxipy support HTTP/2?
Yes. It offers full HTTP/2 support when TLS is enabled, along with intelligent streaming for large files and binary content.
What load balancing algorithms does Proxipy support?
Round Robin, Weighted Round Robin, Least Connections, Weighted Least Connections, Least Response Time, Source IP Hash, URI Hash, Header Hash, and Random.
Can Proxipy protect private IP ranges?
Yes. It includes private IP protection, blocked hosts, suspicious-pattern detection, and optional HTTPS-only enforcement out of the box.
Does Proxipy provide health checks and metrics?
Yes. It exposes /health, /metrics, and /stats endpoints for health checks, performance metrics, and HAProxy-style load balancer statistics.
Is Proxipy open source?
Yes. It is MIT-licensed and available at github.com/ayoubzulfiqar/proxipy.
How is Proxipy configured?
It supports YAML configuration with hot reload and environment variables, including server settings, load balancer rules, security policies, rate limits, and middleware ordering.
Can Proxipy handle WebSocket and TCP traffic?
Yes. It supports HTTP, HTTPS, WebSocket, TCP, and UDP through a configurable multi-protocol proxy layer.