The proxy can provide a controlled entry point for routing, authentication or other request handling before traffic reaches the application. Which protections it supplies depends on the actual deployment.
A backend that trusts identity assertions from a proxy needs a reliable trust boundary. Unprotected alternate access or incorrectly accepted assertions can undermine that design.
ELI5
Think of a reception desk that receives visitors before directing them to an office. The desk acts in front of the office rather than replacing its work.
For example, an authenticated proxy can check who a user is before forwarding an approved request to a private control panel.
Does any reverse proxy automatically authenticate users?
No. Authentication must be supplied and configured by the chosen proxy or another trusted component.
Can the backend ignore all access controls behind a proxy?
No. The trust and routing assumptions need to be correct, and sensitive operations still require suitable authorization.
