diff --git a/weed/s3api/auth_signature_v4.go b/weed/s3api/auth_signature_v4.go
index f3b2720ee..c70027106 100644
--- a/weed/s3api/auth_signature_v4.go
+++ b/weed/s3api/auth_signature_v4.go
@@ -719,9 +719,11 @@ func extractHostHeader(r *http.Request) string {
 
 	forwardedHost := r.Header.Get("X-Forwarded-Host")
 	forwardedPort := r.Header.Get("X-Forwarded-Port")
+	forwardedProto := r.Header.Get("X-Forwarded-Proto")
 
 	// If X-Forwarded-Host is set, use that as the host.
 	// If X-Forwarded-Port is set, use that too to form the host.
+	// If X-Forwarded-Proto is set, check if is it default to omit the port.
 	if forwardedHost != "" {
 		extractedHost := forwardedHost
 		host, port, err := net.SplitHostPort(extractedHost)
@@ -731,7 +733,11 @@ func extractHostHeader(r *http.Request) string {
 				forwardedPort = port
 			}
 		}
-		if !isDefaultPort(r.URL.Scheme, forwardedPort) {
+		scheme := r.URL.Scheme
+		if forwardedProto != "" {
+			scheme = forwardedProto
+		}
+		if !isDefaultPort(scheme, forwardedPort) {
 			extractedHost = net.JoinHostPort(extractedHost, forwardedPort)
 		}
 		return extractedHost