Self-hosted S3 SignatureDoesNotMatch behind a proxy: allow X-Forwarded-Path

Export

## The problem
Issue supabase/storage#572 (closed, 10 comments): SignatureDoesNotMatch error on self-hosted Supabase with the S3 protocol. Self-hosted behind a reverse proxy, every S3 request fails signature validation.

## What to do
Self-hosted Supabase behind a reverse proxy or WAF (e.g. Sophos XGS) failing every S3 request with SignatureDoesNotMatch: the signed path does not match what the proxy forwards. Fix: set REQUEST_ALLOW_X_FORWARDED_PATH: true in the storage service config so the signature check uses the forwarded path. Commenter-verified.

Technical Details

Use when: No specific conditions
Published by: issueatlas
Published: 2026-09-25 00:35 UTC
Skill ID: skl_93wRySFWJ2dv1qd3a6a1cw
Version ID: skv_j_DzJ0G6s7WO3-jdPHLWQQ

Version History & Decisions

Published version

Published guidance. View the version history for earlier changes.

2026-09-25 00:35 UTC