---
title: "Proxy Configuration"
slug: "proxy-configuration"
tags: ["proxy", "embed", "same origin"]
updated: 2026-05-04T16:56:44Z
published: 2026-05-04T16:56:44Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.decisions.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Proxy Configuration

## Overview

Decisions uses cookies for authentication and iFrames for embedding Forms. Decisions has the ability to handle proxied requests so that all traffic goes back through the host site. This allows everything to remain as same-origin from the browser's point of view. This ability is useful for self-hosted scenarios, where it is less likely that IIS or another technology is in between and could be used as a reverse proxy.

Browser Change to Cross-Domain Cookies  
With iPadiOS 13.4+ and Safari 13.1+, cross-domain cookies are no longer allowed. As a result, embedded iFrames cannot authenticate Forms on Mac OS Safari or iOS at all. To learn more about this issue, visit [Full Third-Party Cookie Blocking and More](https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/).

---

## Configuration

The following example will demonstrate how to configure the [Settings.xml](/v9/docs/system-settings-overview-settings-xml) file for a proxy.

1. Navigate to**C:\Program Files\Decisions\Decisions Server** and open the **Settings.xml**file.
2. Edit the Settings.xml file to include a **true**value for **AllowProxyFrom**and include the appropriate 'schema: host'**value for the **ProxyFromWhiteList**configuration option.

| Configuration | Description |
| --- | --- |
| AllowProxyFrom | True or False value. Allows the feature to be enabled or disabled. Default is false. |
| ProxyFromWhiteList | Comma-separated string-list of 'schema: host' values. Specifying a 'schema: host' value will limit where Decisions UI will rewrite UI traffic to. If nothing is specified, it will allow proxies from anywhere. |

```markup
<Settings>
 ...
 <ForceBaseURI />
 <AllowProxyFrom>true</AllowProxyFrom>
 <ProxyFromWhiteList>http://site-1,https://site-2</ProxyFromWiteList>
 ...
</Settings>
```

Proxy Setup When Running as a Non-Admin Service AccountWhen the Decisions service runs under a standard (non-admin) local Windows account, transparent proxy configuration must also be applied under the same non-admin account used by the Decisions service (and the IIS Application Pool identity when IIS hosting is used).  
For standard-user setup details, including service identity and IIS configuration, refer to [Running as a Non-Admin](https://documentation.decisions.com/docs/running-as-a-non-admin-user).

After enabling the proxy, the proxy will forward traffic, for example, from https://host-server/decisions to https://d-server/decisions. It will also change the origin of each request and add '*x-proxied-from: "https://host-server"*'.

If the base path is different than the proxy test path, then the proxy will rewrite the base path. This could mean clearing it of its host at the root or setting it to the actual path. If there is a specified path, there is an additional header, *x-proxied-from-path-base*, which allows the user to specify a different base path.

#### Proxy with 8 at root

When the proxy is at the root, the proxy will forward traffic (e.g., from *https://host-server/decisions* to *https://d-server/)*and change the origin of each request. It will then rewrite the path (e.g., "/decisions" to ""') and add 'x-proxied-from: "https://host-server"'.

#### Proxy at Different Path Base

When the proxy is at a different path base, the proxy will forward traffic (e.g., from *https://host-server/decisions* to *https://d-server/d-8*) and change the origin of each request. It will then rewrite the path (e.g., "/decisions" to "/d-8) and add 'x-proxied-from: "https://host-server"' and 'x-proxied-from-path-base: "/d-8"'.