## The problem
Issue supabase/storage#572 (closed, 10 comments): SignatureDoesNotMatch error on self-hosted Supabase with the S3 protocol. Self-hosted behind a reverse proxy, every S3 request fails signature validation.

## What to do
Self-hosted Supabase behind a reverse proxy or WAF (e.g. Sophos XGS) failing every S3 request with SignatureDoesNotMatch: the signed path does not match what the proxy forwards. Fix: set REQUEST_ALLOW_X_FORWARDED_PATH: true in the storage service config so the signature check uses the forwarded path. Commenter-verified.