Set up a reverse proxy to route Universal Tag requests through your own domain so the browser treats tracking as first-party.

Your site must be served over HTTPS. All proxy requests require a secure connection.
You need access to modify your web server configuration files.
The default proxy path is /proxydirectory/ — contact your CIE if this conflicts with your existing URL structure.
Restart your web server after applying any configuration changes before testing.
Schedule a verification session with your CIE before deploying to production.

Why you should add a reverse proxy to your CJ Universal Tag

The reverse proxy intercepts tag requests from the browser and forwards them to CJ's tracking server — without the browser ever making a direct third-party request.

Third-Party Cookie Resilience

Because tracking requests originate from your own domain, tags execute reliably in Safari, iOS, and other browsers that restrict third-party cookies.

Server-Side Request Forwarding

Your web server forwards tracking requests to CJ at mczbf.com, passing the headers required to preserve complete attribution.

First-Party Cookie Persistence

Cookies are written as first-party on your domain, allowing them to persist well beyond the 24-hour limit Safari imposes on script-set cookies.

Conversion Recovery

Recover attributed conversions from Safari and iOS traffic that would otherwise go unrecorded, supporting more accurate publisher payouts.

Implementation

Reverse Proxy Setup

0 steps

Proxy Path Setup

Configure your reverse proxy to intercept requests at your proxy directory and forward them to CJ's tracking server.

Click any row to see type, format, and value examples.

Parameter

Description

Required

Incoming Path

The path on your domain that receives CJ tag requests from the browser.

Required

Type: String

Examples

https://www.yourdomain.com/proxydirectory/

Note: The /proxydirectory/ path is the default. If it conflicts with your existing URL structure, contact your CIE for an alternative.

Forwarding Target

CJ's tracking server that receives the forwarded requests from your proxy.

Required

Type: String

Examples

https://www.mczbf.com/

Note: The trailing slash is required. Removing it will cause the proxy to forward the full path including /proxydirectory/ to CJ's server.

Required HTTP Headers

Your proxy must pass the following five headers with every forwarded request. Missing or malformed headers will cause tracking to fail or attribution to be incorrect.

Click any row to see type, format, and value examples.

Parameter

Description

Required

X-Forwarded-For

The customer's originating IP address. Must be IPv4 format only.

Required

Type: StringFormat: IPv4

Examples

192.168.1.100

Note: IPv6 addresses are not supported. Ensure your server extracts and forwards the IPv4 address only.

X-Forwarded-Host

Your website's domain, without the protocol prefix.

Required

Type: String

Examples

www.yourdomain.com

X-Forwarded-Server

The hostname of the server handling the proxy request.

Required

Type: String

Examples

web-server-01

X-Forwarded-Request-Host

Your website's domain. Must match the value of X-Forwarded-Host exactly.

Required

Type: String

Examples

www.yourdomain.com

Note: A mismatch between X-Forwarded-Request-Host and X-Forwarded-Host may cause CJ to reject the request.

X-Forwarded-Request-Path

The full path of the incoming tag request, including the proxy directory.

Required

Type: String

Examples

/proxydirectory/tags/TAG_ID/tag.js

Note: Pass the complete request path — not just the proxy directory root. Passing only /proxydirectory/ will cause CJ to misidentify the request.

Server Configuration

Apache

This configuration uses mod_proxy and mod_proxy_http. Confirm both modules are enabled on your server before applying.

Apache

# Required Modules
LoadModule ssl_module          modules/mod_ssl.so
LoadModule proxy_module        modules/mod_proxy.so
LoadModule proxy_http_module   modules/mod_proxy_http.so

# SSL Proxy Support
SSLProxyEngine on

# Required Headers
RequestHeader add "X-Forwarded-Request-Path" "%{REQUEST_URI}s"
RequestHeader add "X-Forwarded-Request-Host" "%{HTTP_HOST}s"

# Proxy Forwarding
ProxyPass        "/proxydirectory/" "https://www.mczbf.com/"
ProxyPassReverse "/proxydirectory/" "https://www.mczbf.com/"

Parameter

Description

Required

SSLProxyEngine

Enables SSL support for outbound proxy connections to CJ's HTTPS server.

Required

ProxyPass

Forwards incoming requests from /proxydirectory/ to CJ's tracking server.

Required

ProxyPassReverse

Rewrites response headers from CJ's server so they correctly reference your domain on the way back to the browser.

Required

NGINX

This configuration uses NGINX's built-in proxy_pass directive. Replace YOUR_SERVER_HOST_NAME with your actual server hostname before deploying.

NGINX

server {
    server_name YOUR_SERVER_HOST_NAME;

    location /proxydirectory/ {
        proxy_ssl_server_name on;
        proxy_pass https://www.mczbf.com/;

        # Required Headers
        proxy_set_header X-Forwarded-For          $remote_addr;
        proxy_set_header X-Forwarded-Host         $host;
        proxy_set_header X-Forwarded-Server       $server_name;
        proxy_set_header X-Forwarded-Request-Host $host;
        proxy_set_header X-Forwarded-Request-Path $request_uri;
    }
}

Click any row to see type, format, and value examples.

Parameter

Description

Required

proxy_ssl_server_name

Enables SNI for outbound SSL connections so NGINX can correctly establish a secure connection to mczbf.com.

Required

proxy_pass

Forwards the request to CJ's tracking server. The trailing slash strips /proxydirectory/ from the forwarded path.

Required

Note: Do not remove the trailing slash from https://www.mczbf.com/ — without it, NGINX forwards the full /proxydirectory/ path to CJ's server, which will break tracking.

Need help?

Submit a support ticket for account-specific support.

How to submit a ticket →