---
title: Run Xperience by Kentico behind a proxy server
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

If you wish to host Xperience behind a proxy server or another service that takes over the application's public domain (e.g., [Azure Application Gateway](https://azure.microsoft.com/en-in/products/application-gateway/)), you need to ensure request URLs from all parts of the application are generated correctly (targeting the proxy domain). Otherwise, you may encounter issues with [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) policies when performing certain actions.

![Accessing an Xperience application through a reverse proxy server](https://docs.kentico.com/docsassets/documentation/run-xperience-by-kentico-behind-a-proxy-server/Proxy_Server.png "Accessing an Xperience application through a reverse proxy server")

To correctly configure Xperience running behind a proxy service, you need to:

1. [Set up Forwarded Headers Middleware](#setting-up-forwarded-headers-middleware) for your Xperience application.
2. [Consider domain alias requirements](#domain-aliases-in-proxy-scenarios).

## Setting up Forwarded Headers Middleware

See the [Configure ASP.NET Core to work with proxy servers and load balancers](https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer) article to learn about Forwarded Headers Middleware.

The following example shows basic forwarded headers configuration in a .NET application's [startup class](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/startup) (_Program.cs_).

```csharp title="Program.cs -- Forwarded headers configuration"
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.HttpOverrides;
using Microsoft.Extensions.DependencyInjection;

using Kentico.Web.Mvc;

// ...

// Configures the Forwarded Headers Middleware options
builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    // Enables processing of all 'X-Forwarded' headers (-For, -Host, -Proto and -Prefix)
    // The 'X-Forwarded-Host' header is required
    // Enable or disable the other headers according to your proxy environment
    options.ForwardedHeaders = ForwardedHeaders.All;

    // Accepts forwarded headers only from the subnet of your proxy servers
    // Without a matching entry, the middleware ignores the headers without raising an error
    options.KnownIPNetworks.Add(System.Net.IPNetwork.Parse("10.0.1.0/24"));

    // Accepts only the listed host names in the 'X-Forwarded-Host' header
    options.AllowedHosts.Add("www.example.com");
});

// ...

var app = builder.Build();

// ...

// Enables the Forwarded Headers Middleware
app.UseForwardedHeaders();

// ...

app.UseStaticFiles();
app.UseKentico();

// ...
```

By default, the middleware accepts forwarded headers only from the loopback address. Requests that arrive through any other proxy, such as Azure Application Gateway or Azure Front Door, keep the scheme and host of the proxy's request, and the application raises no error. Add the address of each proxy to `KnownProxies`, or the subnet of your proxies to `KnownIPNetworks`. List the public domains of your website channels in `AllowedHosts`, so that a forged `X-Forwarded-Host` header can't change the domain in generated links.

Setting the `ASPNETCORE_FORWARDEDHEADERS_ENABLED` environment variable to `true`, for example, as an Azure App Service application setting, doesn't replace this configuration. The variable enables only the `X-Forwarded-For` and `X-Forwarded-Proto` headers, and it accepts forwarded headers from any proxy (see [Forward the scheme for Linux and non-IIS reverse proxies](https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer#forward-the-scheme-for-linux-and-non-iis-reverse-proxies)). Forwarded headers from untrusted proxies make IP spoofing attacks possible.

Adjust the configuration based on the requirements of your proxy environment.

## Domain aliases in proxy scenarios

If you need to access the Xperience application through a different domain than the proxy server's public domain (for example a back end server domain in a local development or testing environment), you also need to add [Domain aliases](https://docs.kentico.com/documentation/developers-and-admins/configuration/website-channel-management.md#domain-aliases-and-environment-specific-domains) for your website channel.