title: WSO2-IS behind a reverse proxy
body: <p>I'm trying to use WSO2 Identity Server behind a reverse proxy to not expose ip and port when I use wso2 custom pages like &quot;Create Password&quot; and &quot;Reset Password&quot;, but I'm getting an error.</p>
  <p>When I try to log in on carbon it redirect to login_action.jsp and it shows:
  <br/><strong>login_action.jsp - 403 Forbidden.</strong></p>
  <p>The steps that I did to configure were:<br/>
  deployment.toml</p>
  <pre><code>[server]
  offset = &quot;1&quot;
  hostname = &quot;example.com&quot;
  node_ip = &quot;xxx.xxx.xx.xxx&quot;
  base_path = &quot;https://$ref{server.hostname}:${carbon.management.port}&quot;
  proxy_context_path = &quot;/is&quot;
  
  [transport.https.properties] 
  proxyPort = 443
  
  </code></pre>
  <p>nginx.conf</p>
  <pre><code>server {
  
      server_name example.com;
      access_log  /var/log/nginx/dev_mtz_access.log;
      error_log  /var/log/nginx/example.com.error_log debug;
  
      proxy_cache one;
      proxy_cache_key $request_method$request_uri;
      proxy_cache_min_uses 1;
      proxy_cache_methods GET;
      proxy_cache_valid 200 1y;
      ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
      listen 80;
      listen 443 ssl;
      ssl_certificate /etc/letsencrypt/certs/cup.crt;
      ssl_certificate_key /etc/letsencrypt/private/cup.key;
  
      rewrite \w*(carbon|admin)$ $1/ permanent;
  
       location /is/ {
          proxy_pass                            https://csm-wso2-is:9444/;
          proxy_redirect                        https://example.com/authenticationendpoint/ https://example.com/is/authenticationendpoint/;
          proxy_redirect                        https://example.com/accountrecoveryendpoint/ https://example.com/is/accountrecoveryendpoint/;
          proxy_redirect                        https://example.com/oauth2/ https://example.com/is/oauth2/;
          proxy_redirect                        https://example.com/carbon/ https://example.com/is/carbon/;
          proxy_http_version                    1.1;
          proxy_cache_bypass                    $http_upgrade;
          # Proxy headers
          proxy_set_header Upgrade              $http_upgrade;
          proxy_set_header Connection           &quot;upgrade&quot;;
          proxy_set_header Host                 $http_host;
          proxy_set_header X-Forwarded-For      $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Server   $host;
          proxy_set_header X-Forwarded-Host     $host;
          # Proxy timeouts
          proxy_connect_timeout                 3600s;
          proxy_send_timeout                    3600s;
          proxy_read_timeout                    3600s;
        } 
  
        location /carbon/admin/js/csrfPrevention.js {
         proxy_set_header X-Forwarded-Host   $host;
         proxy_set_header X-Forwarded-Server $host;
         proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
         proxy_set_header Host               $http_host;
         proxy_read_timeout                  5m;
         proxy_send_timeout                  5m;
         proxy_pass                          https://example.com/is/carbon/admin/js/csrfPrevention.js;
  
         proxy_http_version                  1.1;
         proxy_set_header Upgrade            $http_upgrade;
         proxy_set_header Connection         &quot;upgrade&quot;;
        } 
  </code></pre>
  <p>I didn't find any documentation explaining how to achieve, only on WSO2-APIM</p>