I have set up GeoServer to run behind an Nginx proxy as follows:

listen 443 ssl http2 ;
listen [::]:443 ssl http2 ;

location / {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Proto http;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

It is serving up map layers perfectly this way. However, when I try to log into the admin panel, I get the following error:


Problem accessing /geoserver/web/;jsessionid=swynjc84o5oz1k0uu6xkhf9c7. Reason:

    Server Error
Caused by:

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";"
    at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:265)
    at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:245)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
    at org.geoserver.security.GeoServerSecurityFilterChainProxy.doFilter(GeoServerSecurityFilterChainProxy.java:141)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.LoggingFilter.doFilter(LoggingFilter.java:90)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.XFrameOptionsFilter.doFilter(XFrameOptionsFilter.java:79)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.GZIPFilter.doFilter(GZIPFilter.java:42)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.SessionDebugFilter.doFilter(SessionDebugFilter.java:46)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.FlushSafeFilter.doFilter(FlushSafeFilter.java:42)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
    at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:577)
    at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)
    at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1127)
    at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)
    at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
    at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1061)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
    at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:215)
    at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:110)
    at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)
    at org.eclipse.jetty.server.Server.handle(Server.java:499)
    at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:310)
    at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:257)
    at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:540)
    at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:635)
    at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:555)
    at java.lang.Thread.run(Thread.java:748)

I'm not very adept at Java server configurations, and only tangentially with Nginx administration. My guess is that there is some issue here in the way Nginx is proxying requests.

I have searched for answers on this issue, but only come up with solutions for Apache servers.

Update: after some more testing, I found out that I can get the admin web portal working using the following:

location /geoserver/ {

I think this narrows the issue down to Nginx configuration. Here's what I'm trying to achieve: use a URL like https://geoserver.myserver.com/[...] instead of using https://geoserver.myserver.com/geoserver/[...].

  • Probably needs fixing in server.xml file on Tomcat
    – nmtoken
    Commented Dec 22, 2018 at 9:28
  • I had the same problem using Apache2 and was also able to solve it by appending /geoserver to the proxypass address. Thanks! Commented Jan 9, 2020 at 22:33

2 Answers 2


I was able to get it working with the following Nginx settings:

location / {
    proxy_pass_header Set-Cookie;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

location /geoserver/ {
    proxy_pass_header Set-Cookie;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

To get layer previews to work, I also added my domain name under Settings > Global > Proxy Base URL in the GeoServer admin site:


and make sure to check Use headers for Proxy URL.

After that I reloaded the configuration

Server Status > Reload

reloaded Nginx

sudo service nginx reload

and restarted GeoServer


What this achieves:

  • Puts the site behind SSL.
  • WMS URLS do not include the redundant geoserver directory.
  • The admin portal now works and lets users log in.

What I haven't been able to get working yet:

  • The URLs in the admin portal still contain the geoserver folder, as in https://geoserver.myserver.com/geoserver/web, for many pages. This doesn't seem to affect functionality, though, and since it's only in the admin portal, I'll be the only one who sees it.
  • This location blocks configuration works for me for http only. When I add listen 443 ssl and SSL certificates instead of just listen 80, it loads the geoserver home page with https, but admin login redirects to http://<my-host>/geoserver/j_spring_security_check showing The information you’re about to submit is not secure. Is there something that I am missing in the configuration?
    – AnjK
    Commented Feb 28, 2022 at 8:08
  • Did you ever find a solution to the login form redirect problem?
    – Shayne
    Commented Nov 24, 2022 at 5:31
  • @Shayne I'm not sure that I have, it has been some time since I worked with geoserver due to a change in employment. Commented Nov 25, 2022 at 13:58

This is a known issue and is due to an (unplanned) increase in security when Spring was upgraded.

One suggested work around is to add


to the web.xml file.

  • While I have seen numerous articles and posts referencing this issue, I think it may have been resolved, at least on Linux, as I was able to get it working without making this change, and prior I had it working (but in that case WMS URLs wouldn't work). I posted my solution to get it working, I hope I didn't miss anything. Thanks for your suggestion, though. :) Commented Dec 23, 2018 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.