Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIf an NGINX endpoint answers curl but fails in Chrome or Firefox, the two clients are almost certainly not making an equivalent request or are not applying the same rules to the response. Compare the complete URL, DNS name, port, path, redirects, headers, TLS/SNI handshake, cookies and status code first. Then check browser-only enforcement: HTTPS mixed-content blocking and the same-origin/CORS policy.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The fastest route to the fault is to copy the failing browser request as cURL from DevTools, replay it with verbose output, and correlate it with NGINX access and error logs. The sections below identify what to compare and how to correct each layer without guessing.
As an Amazon Associate I earn from qualifying purchases.
What the symptom actually proves
A successful command such as curl http://127.0.0.1/health proves only that one curl process reached one address and received an HTTP response. It does not prove that a browser resolved the same hostname, connected to the same port, selected the same NGINX server block, completed the same TLS handshake, followed the same redirects, sent the same cookies, or was permitted to expose the response to JavaScript.
Use this layer model to keep the investigation ordered:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Layer | What can differ | Typical browser symptom | Evidence to collect |
|---|---|---|---|
| Transport | HTTP versus HTTPS, DNS address, TCP port, TLS certificate and SNI | Certificate warning, connection failure, timeout, or no HTTP request | Browser security details, curl -v, DNS result and NGINX logs |
| Routing | listen address, port, server_name, and the Host header |
Wrong site, default page, 404, or an unexpected redirect | Request hostname, selected virtual host, $host, status and request URI |
| Path forwarding | location matching and whether proxy_pass contains a URI |
Backend 404, wrong API route, or a response that differs by path | Public path, upstream path, NGINX configuration and upstream log |
| Browser policy | Mixed-content and same-origin/CORS checks | Console block, failed fetch, or a response visible in Network but unavailable to script | Console message, request origin, preflight request and response headers |
| Application state | Redirect targets, cookie attributes, authentication and session state | Login loop, missing session, or a redirect to an internal address | Every 3xx response, Location and Set-Cookie header |
Treat the browser’s Network panel as the authoritative description of what failed. A page that displays an error may have failed before HTTP, after HTTP but before JavaScript received the response, or inside application code.
1. Reproduce the browser’s exact request
Copy the request from DevTools
- Open the page in the browser and press
F12(or choose Developer Tools from the browser menu). - Select the Network panel, enable recording, and reload the page.
- Click the failed document, fetch, XHR, script, stylesheet or other request. Record its full URL, method, status, remote address, request headers, response headers and timing.
- Use the request’s context menu and choose Copy as cURL. This preserves details that a hand-written command often misses, such as a non-default port, query string, cookies, an
Originheader or a particular method.
Run the copied command in a terminal, then compare it with a deliberately simple probe:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallcurl -v https://example.test/path
curl -I https://example.test/path-v shows name resolution, connection setup, the TLS handshake, request headers, response headers and the final status. -I requests headers only, which is useful for checking redirects and server selection without downloading a response body. Keep the hostname, scheme, port and path identical to the browser request; replacing the public name with 127.0.0.1 changes the test.
Handle redirects deliberately
Inspect the first response before following it. A 3xx Location header can point to an internal hostname, a different scheme, an incorrect port or a path that does not exist publicly. To see the eventual destination with curl, add -L:
curl -v -L https://example.test/pathDo not assume curl and a browser execute the same redirect flow. Browsers can perform JavaScript or HTML meta-tag redirects; curl does not execute page scripts and does not follow ordinary HTTP redirects unless -L is supplied. A body that curl prints therefore does not prove that a browser can complete the page’s next action.
2. Confirm NGINX selected the intended server block
Test the public hostname, not just localhost
NGINX chooses a server by the address and port in listen, then compares the request’s Host with server_name. If no name matches, NGINX serves the default server for that address and port. A localhost curl test can consequently reach a different configuration from the one selected for the browser’s public hostname.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
When DNS is not yet correct, test the real name against a known address while retaining the browser’s TLS name and HTTP Host:
curl -v --resolve example.test:443:IP https://example.test/pathReplace IP with the address that should receive traffic. The --resolve option changes where curl connects while leaving example.test in the URL, which lets NGINX match the intended server_name and lets TLS use the intended SNI name. Compare the result with the browser’s actual DNS destination.
Look for default-server symptoms
An unexpected welcome page, a certificate for another site, an application 404, or a redirect to a different domain often means the request landed in the default server. Check that the browser URL’s exact hostname appears in the correct server_name directive and that the corresponding listen directives cover the requested port, commonly 80 for HTTP and 443 for HTTPS. If several blocks share a port, verify which one is marked or treated as the default and do not rely on the order of files as an accidental routing rule.
3. Verify location and proxy_pass path handling
The trailing URI changes what reaches the upstream
NGINX handles proxy_pass differently depending on whether the directive includes a URI. When it includes a URI, NGINX replaces the part of the request URI that matched the location with the URI in proxy_pass. When it has no URI, NGINX forwards the full request URI (subject to the normal processing of the request).
Recommended Free Tools
For example, a request to /api/users matched by location /api/ can reach a different upstream path depending on whether the proxy target is written with a path component. A browser may request /api/users while a manual curl test targets /users directly, concealing the rewrite error. Capture the public request URI and the route recorded by the upstream application, then make the configuration produce that exact route.
Check the proxied Host header
By default, NGINX changes the Host and Connection fields in proxied requests. NGINX documents this behavior explicitly. If the upstream application chooses tenants, builds absolute URLs, validates a host, or issues redirects based on the public name, preserve that name deliberately:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
location / {
proxy_pass http://backend;
proxy_set_header Host $host;
}Use the configuration appropriate to your application and verify the result in upstream logs. Do not infer the upstream Host from the address in proxy_pass; they are separate values.
Compare methods and headers
A browser page may issue an OPTIONS preflight, a POST with a JSON content type, or a request carrying an Origin and cookies. A basic curl command usually sends a GET without those headers. Replay the method and relevant headers from the copied browser command before changing NGINX. If the copied request succeeds but a simple curl command does not, the difference is request construction rather than browser rendering.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →4. Check HTTPS, certificates and TLS/SNI before debugging HTTP
TLS happens before the HTTP request
The browser must complete a TLS handshake before it can send an HTTPS request. During that handshake, Server Name Indication (SNI) identifies the hostname for which the client wants a certificate and virtual server. A certificate with the wrong name, an incomplete chain, an expired certificate, an unsupported protocol, or port 443 reaching the wrong machine can stop the browser before NGINX receives an HTTP request.
Inspect the browser’s certificate details for the requested name, chain and expiration, and confirm that port 443 reaches the intended NGINX instance. Then run curl against the same HTTPS URL with normal certificate verification. A command that disables verification, such as one using -k or --insecure, only demonstrates that an HTTP response can be obtained while trust checks are bypassed; it is not evidence that a normal browser will accept the connection.
Distinguish certificate failure from an HTTP failure
If the browser shows a certificate interstitial and no request appears in NGINX access logs, stay at the TLS or network layer. If the browser completes the handshake and an HTTP request appears, move on to server selection, redirects, proxying or browser policy. This distinction prevents changing application routes when the browser never reached them.
5. Follow every redirect and inspect cookies
Audit each Location value
Open the Network panel’s request chain and inspect every 301, 302, 303, 307 or 308 response. Look for an internal service name, an HTTP URL emitted from an HTTPS site, an unexpected port, a missing path prefix or a host that is not reachable from the user’s network. Correct the application’s canonical URL or the NGINX rewrite that generated the value; changing only the first request leaves the broken destination intact.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Compare session cookies
When anonymous content works but login, checkout or another session-dependent action fails, compare the browser’s Set-Cookie response with the cookies sent on the next request. The Domain controls which hosts receive a cookie, Secure restricts it to HTTPS, and SameSite controls when it is sent in cross-site contexts. A cookie scoped to an internal hostname, marked for a different parent domain, or delivered without the attributes required by the actual navigation can produce a login loop even though curl displays the initial response body.
Use a curl cookie jar only when reproducing the same flow, for example with -c cookies.txt and -b cookies.txt. A one-off curl request without stored cookies is not a valid comparison for an authenticated browser session.
6. Remove mixed-content blocks
A page loaded over HTTPS is not allowed to freely fetch insecure HTTP resources. Browsers can block or upgrade HTTP scripts, stylesheets, fonts, API calls and downloads, depending on the resource type and browser behavior. The request may therefore work when you paste its HTTP URL into curl while being refused when a secure page embeds it.
Read the exact warning in the browser Console and inspect the blocked request in Network. Use an HTTPS URL for the resource, or use a same-origin relative URL such as /api/data so the page’s scheme is retained. Fix generated absolute URLs, redirect targets and asset manifests that still emit http://. Do not treat a successful direct HTTP probe as proof that the resource is usable from an HTTPS document.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →7. Fix same-origin and CORS failures
Determine whether the origins differ
MDN defines two URLs as having the same origin only when their protocol, host and port are the same. Changing any one of those values makes a browser JavaScript request cross-origin. For example, an HTTPS page calling an HTTP API, a page on app.example.test calling api.example.test, or a call from port 443 to port 8443 requires the browser’s cross-origin rules to be satisfied.
A cross-origin response can appear in the Network panel while JavaScript receives a CORS error. That is different from an NGINX 404 or an application exception: the browser is withholding the response from the calling script.
Return an exact allowed origin
Configure the API response to include an Access-Control-Allow-Origin value that exactly matches the requesting Origin when that origin is permitted. Match the scheme, host and port; a near match is not sufficient. If the request uses credentials such as cookies or HTTP authentication, do not use Access-Control-Allow-Origin: *. Credentialed requests require an explicit origin and the corresponding credential permission.
Handle the OPTIONS preflight
Before a non-simple cross-origin request, the browser can send an OPTIONS preflight describing the intended method and headers. Ensure that NGINX and the upstream return a successful status for this request and include the required CORS response headers, including the allowed origin, methods and headers that the browser asked to use. Confirm that an authentication rule, redirect, access-control rule or proxy path is not sending the preflight to a login page or a different server block.
In DevTools, compare the preflight’s URL and response with the subsequent request. A curl command that sends only the final GET cannot validate a preflight path; reproduce the browser’s OPTIONS request when testing.
8. Use NGINX logs to locate the failing layer
No browser request in the access log
If the browser’s request is absent from NGINX access logs, NGINX did not process an HTTP request from that attempt. Investigate DNS, connectivity, firewall reachability, TLS certificate and SNI, or a browser policy that stopped the request before transmission. The Console and the browser’s security details are more useful than changing proxy directives at this stage.
Request present in access logs
If it appears, correlate the timestamp with the status, upstream address, $host, $request_uri and, for cross-origin calls, $http_origin. Compare the access entry with the NGINX error log and the upstream application log. This reveals whether NGINX selected the wrong server, sent an unexpected path, received an upstream error, or returned a response missing browser-required headers.
For a temporary diagnostic format, include the fields your logging policy permits, such as the request method, status, host, URI, upstream status and origin. Remove sensitive headers and restore the normal format after troubleshooting. A matching access-log entry with a successful upstream status does not by itself prove that JavaScript was allowed to read the response; check the response headers and Console as well.
A practical order of operations
- Record the failing browser request in Network, including its exact URL, method, status, redirect chain and Console message.
- Replay that request with the copied cURL command, then use
curl -vand, when relevant,-Lagainst the same public hostname, scheme, port and path. - Use
--resolvewhen you need to test a specific address without changing the hostname used forHostand SNI. - Check whether the request reached the intended
listen/server_nameblock rather than the default server. - Verify the
locationmatch, theproxy_passURI form, the upstream route and the proxiedHostvalue. - Separate TLS failures from HTTP failures, and never use an insecure curl result as proof of browser trust.
- Inspect every redirect and the cookie attributes if the problem appears only during navigation or authentication.
- For page resources, resolve mixed-content warnings. For JavaScript calls across origins, validate the exact CORS response and the
OPTIONSpreflight. - Use access, error and upstream logs to confirm the layer indicated by DevTools rather than making unrelated configuration changes.
This sequence works because each test preserves the information that the previous one established: first the browser’s actual request, then transport, virtual-host routing, path forwarding, application state and finally browser permission to use the response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
