diff --git a/Amazon-S3-API.md b/Amazon-S3-API.md index 9ab64bd..8686336 100644 --- a/Amazon-S3-API.md +++ b/Amazon-S3-API.md @@ -288,6 +288,7 @@ For detailed information about CORS configuration, see the dedicated [[S3-CORS]] SeaweedFS S3 API supports deployment behind reverse proxies with full AWS Signature v4 authentication compatibility. This includes support for: - **X-Forwarded-Host**: Preserves original host header for signature verification +- **X-Forwarded-Port**: Automatically combines with X-Forwarded-Host for non-standard ports - **X-Forwarded-Prefix**: Handles URL path prefix stripping by reverse proxies - **Standard forwarded headers**: X-Forwarded-For, X-Forwarded-Proto, etc. diff --git a/S3-API-FAQ.md b/S3-API-FAQ.md index 84e8098..557b764 100644 --- a/S3-API-FAQ.md +++ b/S3-API-FAQ.md @@ -198,10 +198,13 @@ Ensure all necessary headers are forwarded: ```nginx proxy_set_header Host $host; proxy_set_header X-Forwarded-Host $host; +proxy_set_header X-Forwarded-Port $server_port; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; ``` +**Note**: SeaweedFS automatically combines `X-Forwarded-Host` and `X-Forwarded-Port` for signature verification, omitting standard ports (80 for HTTP, 443 for HTTPS). + ### Testing Your Configuration You can test your reverse proxy configuration using AWS CLI: diff --git a/S3-Nginx-Proxy.md b/S3-Nginx-Proxy.md index 0499cd7..24ac967 100644 --- a/S3-Nginx-Proxy.md +++ b/S3-Nginx-Proxy.md @@ -3,7 +3,7 @@ It's a common concept to put a proxy in front of S3 that handles requests. Nginx For virtual-hosted style URL buckets, you'll need to add a [wildcard DNS record](https://en.wikipedia.org/wiki/Wildcard_DNS_record) for your S3 subdomain. -Make sure the config sets the `X-Forwarded-Host` and optionally the `X-Forwarded-Port` if you are using a non-standard port. Otherwise, the AWS Signature v4 will not be correctly computed by the server, as it uses the Host header to compute the signature on the client side. +Make sure the config sets the `X-Forwarded-Host` and optionally the `X-Forwarded-Port` if you are using a non-standard port. SeaweedFS will automatically combine these headers to reconstruct the correct host information for signature verification. ## Reverse Proxy with URL Path Prefixes @@ -31,6 +31,8 @@ This ensures both regular S3 requests and presigned URLs work correctly with rev ### Important Notes - The `X-Forwarded-Prefix` header should contain the stripped prefix (e.g., `/s3`) +- `X-Forwarded-Port` is automatically combined with `X-Forwarded-Host` for non-standard ports +- Standard ports (80 for HTTP, 443 for HTTPS) are omitted from the host header automatically - Both regular S3 authentication and presigned URLs are supported - This feature works with all S3 operations that require signature verification