What is a 'reverse proxy' and how does it improve security compared to exposing the application server directly?

• A.A reverse proxy stores static files locally and serves them without hitting the origin; co-locating the proxy and app server removes the need to validate forwarded headers, since loopback traffic cannot carry them; X-Forwarded-For is trustworthy end to end because each proxy cryptographically signs the value it appends
• B.A reverse proxy is the opposite of a load balancer - it routes outbound requests from the server to the internet; SIGHUP on any web server process clears the OS page cache, forcing the next request to disk; TLS session resumption stores the master secret in a cookie on the client, scoped by the Secure attribute; logrotate must stop the web server during rotation, as open file handles corrupt compressed archives otherwise
• C.A reverse proxy encrypts all database connections between the app server and database
• D.A reverse proxy forwards client requests to a backend server, hiding the backend server's IP, port, and technology stack; it provides SSL termination, can enforce security headers, absorb DoS traffic, and gives a central point to apply WAF, rate limiting, and request filtering