What Is Node Unblocker? How the Node.js Web Proxy Works and When to Use It

Node Unblocker usually refers to node-unblocker, an open-source web proxy library for Node.js. You run it as middleware in your own server, and it fetches web pages on behalf of a client, rewriting links so that later requests also pass through the proxy.

This article explains what node-unblocker does and does not do, where it fits in a data workflow, its limitations and security risks, and how to set it up safely.

Scope: This article covers running a web proxy you control for permitted purposes. It is not a guide to getting around a website's blocks, rate limits, or regional restrictions.

What node-unblocker is

node-unblocker is middleware for Node.js frameworks such as Express. When a client requests a URL under a prefix such as /proxy/, the middleware:

1. Fetches the target page from your server: The request goes out from the machine running node-unblocker.
2. Rewrites the response: Links, scripts, and other URLs in the page are rewritten so that follow-up requests also go through the proxy.
3. Streams the result back: The client receives the page as if it came from your server. Because the request is made by your server, the target site sees your server's IP address, not the client's.

What it does not do

The name "unblocker" can be misleading, so it helps to be clear:

• It does not rotate IP addresses: All requests come from the server it runs on. Adding rotation requires a separate proxy service.
• It does not handle CAPTCHAs or bot detection: It is a straightforward web proxy, not a tool for disguising automated traffic.
• It does not grant permission: Routing requests through a proxy does not change what a site allows you to access.

Where it can be useful

• Server-side fetching in a region you control: Running the proxy on a server in a specific country lets internal tools view the public version of a page shown in that region.
• Inspecting and debugging traffic: Middleware hooks let developers log or modify requests and responses for testing.
• Testing your own sites: QA teams can view their own sites through a server in a different network or location.
• Learning and prototyping: It is a readable example of how web proxies rewrite and relay content. For collecting public data at scale, a managed service such as MrScraper's Web Scraper API or residential proxies with country selection is usually easier to operate than a self-hosted proxy. In every case, the same rules apply: collect only what each site permits, at reasonable volumes.

Limitations

• Complex sites may break: Modern single-page applications, complex JavaScript, and some sign-in flows may not work correctly through a rewriting proxy. Check the project's README for current limitations.
• One IP address: All traffic shares your server's address, so it is not suited to high request volumes.
• Maintenance: You are responsible for hosting, updates, security patches, and monitoring.

Security risks of running a web proxy

An unprotected web proxy is a serious risk, and is one of the most important things to get right:

• Open proxy abuse: If your proxy is reachable from the internet without restrictions, others can use it to send traffic that appears to come from your server, which can get your IP address blocked and expose you to abuse complaints.

• Server-side request forgery (SSRF): A proxy that fetches any URL can be used to reach internal services, such as cloud metadata endpoints or private admin panels, from inside your network.

• Data exposure: Cookies and session data passing through the proxy may be visible to whoever operates it. To reduce these risks:

• Bind to localhost or a private network: Do not expose the proxy publicly unless you must.

• Require authentication: If it must be reachable remotely, put it behind authentication.

• Allowlist destinations: Permit only the specific domains you need, and block private and internal addresses.

• Log and monitor: Record usage so you can spot misuse quickly.

Tutorial: a restricted local proxy with node-unblocker

This example runs node-unblocker on localhost only, allows a short list of destination domains, and fetches a page title through the proxy.

Step 1: Install dependencies

npm init -y
npm install express unblocker axios cheerio

• express: Runs the web server.
• unblocker: Provides the proxy middleware.
• axios: Makes HTTP requests.
• cheerio: Parses HTML so you can extract data.

Step 2: Create the server

Create a file named server.js:

const express = require('express');
const unblocker = require('unblocker');
const axios = require('axios');
const cheerio = require('cheerio');
 
const app = express();
const PORT = 8080;
const PREFIX = '/proxy/';
 
// Only these destination hosts may be fetched through the proxy.
const ALLOWED_HOSTS = new Set(['example.com', 'www.example.com']);
 
// Reject any proxy request whose destination is not on the allowlist.
app.use(PREFIX, (req, res, next) => {
  try {
    const target = new URL(req.url.slice(1)); // e.g. /https://example.com/ -> https://example.com/
    if (!['http:', 'https:'].includes(target.protocol) || !ALLOWED_HOSTS.has(target.hostname)) {
      return res.status(403).send('Destination not allowed.');
    }
    next();
  } catch {
    return res.status(400).send('Invalid destination URL.');
  }
});
 
// The proxy middleware handles requests under /proxy/.
app.use(unblocker({ prefix: PREFIX }));
 
// Fetch a page through the proxy and return its title.
app.get('/scrape', async (req, res) => {
  try {
    const targetUrl = 'https://example.com/';
    const proxyUrl = `http://127.0.0.1:${PORT}${PREFIX}${targetUrl}`;
    const response = await axios.get(proxyUrl, { timeout: 30000 });
    const $ = cheerio.load(response.data);
    res.json({ title: $('title').text() });
  } catch (error) {
    console.error('Fetch failed:', error.message);
    res.status(502).send('Could not fetch the page.');
  }
});
 
app.use((req, res) => res.status(404).send('Page not found'));
 
// Bind to localhost so the proxy is not reachable from other machines.
app.listen(PORT, '127.0.0.1', () => {
  console.log(`Restricted proxy running at http://127.0.0.1:${PORT}/`);
});

How it works:

• Allowlist check: Requests under /proxy/ are rejected unless the destination is an allowed host using HTTP or HTTPS.
• Proxy middleware: node-unblocker fetches allowed pages and rewrites their links.
• Scrape route: /scrape fetches example.com through the proxy and returns its title.
• Localhost binding: The server listens on 127.0.0.1 only, so other machines cannot use it.

Step 3: Run the server

node server.js

You should see:

Restricted proxy running at http://127.0.0.1:8080/

Step 4: Test it

Visit http://127.0.0.1:8080/scrape in a browser on the same machine. You should receive:

{
  "title": "Example Domain"
}

Requesting a destination that is not on the allowlist, such as http://127.0.0.1:8080/proxy/https://another-site.com/, should return 403 Destination not allowed.

Next steps

• Add destinations deliberately: Add a domain to ALLOWED_HOSTS only after confirming you are permitted to collect from it.
• Extract more fields: Use Cheerio selectors to pull text, links, or other data you need.
• Add rate limiting: Use middleware such as express-rate-limit to cap request volume.
• Add authentication: If the proxy must be reachable beyond localhost, require credentials.

Using a proxy responsibly

• Collect public data only: Limit collection to information any visitor can see without signing in.
• Review each site's rules: Read the terms of use and robots.txt, and follow any restrictions.
• Prefer official sources: Use documented APIs and data programs where they exist.
• Keep volumes reasonable: Add delays and limit concurrency.
• Respect refusals: If a site returns 403 or 429, slow down and review whether the collection is permitted. Do not route around the restriction. See our guide to the 429 Too Many Requests error.
• Respect network policies: Do not use a proxy to get around content filters set by your school, employer, or network administrator.
• Get legal advice: This is general information, not legal advice. See our guide on web scraping and the law.

What we learned

• node-unblocker is a self-hosted web proxy: It fetches pages from your server and rewrites their links.
• It does not rotate IPs or disguise traffic: All requests come from your server's address.
• Security matters most: Bind to localhost, allowlist destinations, and require authentication to avoid running an open proxy.
• Managed services are easier at scale: For permitted collection beyond small experiments, a managed API reduces operational work.
• Permission is unchanged: A proxy changes how requests are routed, not what you are allowed to collect.

Frequently asked questions

What is node-unblocker?

An open-source Node.js library that runs a web proxy as middleware. It fetches pages from the server it runs on and rewrites links so that follow-up requests also pass through the proxy.

Does node-unblocker rotate IP addresses?

No. All requests come from the server running it. IP rotation requires a separate proxy service.

Is it safe to run node-unblocker on a public server?

Only with safeguards. An unrestricted public proxy can be abused by others and can expose your internal network. Bind it to localhost or a private network, require authentication, and allowlist destinations.

Why spend time and resources maintaining your own scraping infrastructure?

Let MrScraper handle the complexity so your team can focus on using the data. No setup fees, and you only pay for successful usage.

Get 1,000 free tokens to test it here.

Can node-unblocker handle every website?

No. Sites that rely heavily on JavaScript or complex sign-in flows may not work correctly through a rewriting proxy. Check the project's README for current limitations.

Should I use node-unblocker for large-scale data collection?

Usually not. It is single-IP, self-maintained infrastructure. For permitted collection at scale, a managed service is easier to operate, and the same responsible-use rules still apply.