# Keycloak on subpath and behind reverse proxy

**URL:** <https://forum.keycloak.org/t/keycloak-on-subpath-and-behind-reverse-proxy/31220>\
**Category:** Configuring the server\
**Created:** [December 19, 2025, 9:36pm UTC](https://forum.keycloak.org/t/keycloak-on-subpath-and-behind-reverse-proxy/31220 "2025-12-19T21:36:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vguttmann](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/vguttmann/32/12421_2.png) [@vguttmann](https://forum.keycloak.org/u/vguttmann)\
**Post date:** [December 19, 2025, 9:36pm UTC](https://forum.keycloak.org/t/keycloak-on-subpath-and-behind-reverse-proxy/31220/1 "2025-12-19T21:36:46Z")

</div>

After something else fundamentally broke, we updated from keycloak 11 (yes, I know) to Keycloak 26. However, we can’t seem to get the proxy config right. We’re using X-Forwarded-For-Headers everywhere, so that’s what we did with Keycloak as well.

Our HAProxy config is as follows:

```auto
backend haproxy
mode http
option forwardfor
    http-request set-header X-Real-IP %[src]
    http-request set-header X-Forwarded-Host %[req.hdr(Host)]
    http-request set-header Host %[req.hdr(Host)]
    http-request set-header X-Forwarded-Proto https
    server fastsso1 192.168.62.6:9012 check

```

We’re building a custom image where we enable Postgres, change the relative HTTP path to /org-auth/auth, and also enable hostname:v2

In Portainer, we’re setting the following environment variables:

- KC\_PROXY\_HEADERS: xforwarded
- KC\_HTTP\_ENABLED: true
- KC\_HOSTNAME: [https://subdomain.domain.com](https://subdomain.domain.com) (we’re doing SSL termination in HAProxy, we also tried without the https, and with the subpath)
- KC\_HOSTNAME\_STRICT: true
- KC\_HTTP\_RELATIVE\_PATH: /org-auth/auth
- KC\_FEATURES: hostname:v2

Now, somehow, all requests end up at [https://https//subdomain.domain.com/org-auth/auth/org-auth/auth/realms/DOMAIN.COM/protocol/openid-connect/auth](https://https//subdomain.domain.com/org-auth/auth/org-auth/auth/realms/DOMAIN.COM/protocol/openid-connect/auth)

As far as I know, we’ve followed all the available documentation regarding hostname and reverse proxies, too, so I’m really at a loss here.

What could cause this doubling up?

---

<div class="post-metadata">

**Author:** ![vguttmann](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/vguttmann/32/12421_2.png) [@vguttmann](https://forum.keycloak.org/u/vguttmann)\
**Post date:** [December 20, 2025, 6:33pm UTC](https://forum.keycloak.org/t/keycloak-on-subpath-and-behind-reverse-proxy/31220/2 "2025-12-20T18:33:33Z")

</div>

Update: The Keycloak config was mostly fine, our authproxies still had bad state in them. In the end, we configured Keycloak as followed, and then restarted all the authproxies, and everything was fine:  
KC\_PROXY\_HEADERS: xforwarded

- KC\_HTTP\_ENABLED: true

- KC\_HOSTNAME: [subdomain.domain.com](https://subdomain.domain.com)

- KC\_HOSTNAME\_STRICT: true

- KC\_HTTP\_RELATIVE\_PATH: /org-auth/auth

- KC\_FEATURES: hostname:v2

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/eb342909d95cf32cbb7517610022c6a0046a9ffb.png) [@system](https://forum.keycloak.org/u/system)\
**Post date:** [June 18, 2026, 6:34pm UTC](https://forum.keycloak.org/t/keycloak-on-subpath-and-behind-reverse-proxy/31220/3 "2026-06-18T18:34:28Z")

</div>

Closed on June 18, 2026, 6:34pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.