App Oauth2 Login in Private Subnet without NAT Gateway

I run My App in Private Subnet and add Oauth2 Login without NAT Gateway.

To do Oauth login, I consider setting proxy server like nginx or squid in Public Subnet.

Here, I would like to ask a question because I am confused about the concept of Proxy.

1. Is Oauth2 Login possible with Forward Proxy? Or should I use Reverse Proxy?

2. Can nginx and squid be run as Forward Proxy and Reverse Proxy at the same time?

3. Is there a way to do Oauth2 Login without NAT Gateway instead of Proxy?