diff --git a/weed/s3api/auth_signature_v4.go b/weed/s3api/auth_signature_v4.go
index 0a156cfce..71ef6cd6e 100644
--- a/weed/s3api/auth_signature_v4.go
+++ b/weed/s3api/auth_signature_v4.go
@@ -664,7 +664,11 @@ func extractSignedHeaders(signedHeaders []string, r *http.Request) (http.Header,
 			extractedSignedHeaders.Set(header, "100-continue")
 		case "host":
 			// Go http server removes "host" from Request.Header
-			extractedSignedHeaders.Set(header, r.Host)
+			if forwardedFor := r.Header.Get("X-Forwarded-For"); forwardedFor != "" {
+				extractedSignedHeaders.Set(header, forwardedFor)
+			} else {
+				extractedSignedHeaders.Set(header, r.Host)
+			}
 		case "transfer-encoding":
 			for _, enc := range r.TransferEncoding {
 				extractedSignedHeaders.Add(header, enc)