iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
curl succeeding does not prove that a browser can load the endpoint. The two clients may use different hostnames, schemes, ports, paths, redirects, headers, TLS/SNI handshakes, cookies, and authentication flows. Browsers also enforce mixed-content and same-origin/CORS rules that curl does not. Fix the problem by reproducing the browser’s exact request, then tracing it through DNS and NGINX server selection, proxy path rewriting, TLS, redirects, browser security policy, and application state.
Start with the exact failure, not a localhost curl test
Write down what “works” and what “fails.” A command such as curl http://127.0.0.1:8080/api tests only one listener and one request. A browser URL such as https://api.example.test/api can use a different DNS address, NGINX server block, port, certificate, path, and policy context. Until those values match, the results are not comparable.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Scheme: HTTP and HTTPS are different origins and use different listeners.
- Hostname:
127.0.0.1, an upstream IP, and the public DNS name can select different NGINX servers. - Port: an explicit port is part of the origin and may reach another process or firewall rule.
- Path and query: a trailing slash, encoded character, or query parameter can select another backend route.
- Request method and headers: a browser may send
OPTIONS, cookies, anOriginheader, or a differentAcceptvalue before the request you noticed. - Response handling: browsers follow redirects, execute JavaScript, apply cookies, and enforce security policy; a basic curl command generally does not.
The fastest way to remove ambiguity is to capture the failing browser request and compare it byte-for-byte with a verbose curl request.
Reproduce the browser request exactly
Copy the request from DevTools
- Open the page in the browser and press
F12(or choose Developer tools). - Select the Network panel, enable Preserve log, and reload the page.
- Click the failed document, script, API call, or preflight request. Record its request URL, method, status, remote address, and response headers.
- Use the request context menu and choose Copy as cURL. This includes the browser’s URL and usually its relevant method and headers.
- Run the copied command from a shell, then run a simpler diagnostic against the same URL:
curl -v https://example.test/path
curl -I https://example.test/path
curl -v -L https://example.test/pathUse -L only when you intentionally want curl to follow redirects. Without it, curl shows the first response and its Location header, which is often the most useful evidence. Compare the complete URL, including scheme, hostname, port, path, and query string. A browser can perform a JavaScript or meta-tag redirect that curl will never perform automatically; the curl FAQ documents this distinction.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Interpret the first difference
| Observation | Likely layer | Next check |
|---|---|---|
| Browser request never appears in NGINX access logs | DNS, connectivity, TLS, or browser policy | Check the browser Console, certificate, DNS result, and whether the request was blocked before transmission. |
| Browser receives a different status or server block than curl | Host, port, or NGINX server selection | Test the public hostname and inspect server_name, listeners, and default-server behavior. |
| Both reach NGINX but backend paths differ | location/proxy_pass rewriting |
Compare the upstream URI and trailing-slash syntax. |
| HTML loads but an API call is blocked | Mixed content, same-origin, or CORS | Read the Console and inspect the API request, including any OPTIONS preflight. |
| Only login or session actions fail | Redirects or cookies | Inspect every Location and cookie attribute. |
Confirm NGINX selected the intended server block
NGINX first chooses a listening address and port, then compares the request’s Host value with server_name. If no name matches, NGINX serves the default server for that address and port. A curl request to localhost can therefore return a perfectly valid response from the wrong virtual host.
Test the public hostname while forcing an IP
Use the public name in the URL so the TLS SNI and HTTP Host remain correct, while --resolve directs the connection to the address you want to test:
curl -v --resolve example.test:443:203.0.113.10 https://example.test/pathReplace the example address with the intended server IP. This test distinguishes a bad DNS record from a bad NGINX configuration. If it works with --resolve but not normally, inspect DNS records, resolver caches, split-horizon DNS, and IPv4 versus IPv6. If it still fails, the issue is on the selected server or beyond it.
Check listeners and default behavior
Ensure the expected server listens on the browser’s port, commonly 443 for HTTPS and 80 for HTTP. Confirm that the certificate-bearing HTTPS server has the requested name in its server_name list. A request arriving on an address without the expected name may fall into a catch-all server that redirects elsewhere or returns a generic response.
Do not use an upstream IP as a substitute for the public hostname when diagnosing a virtual-host problem. The upstream may not have the same certificate, routes, authentication rules, or host-based application configuration.
Check how proxy_pass changes the path
The URI portion of proxy_pass determines whether NGINX replaces the part of the request URI that matched location. With a URI in proxy_pass, NGINX replaces the matching location prefix. Without a URI, NGINX forwards the full request URI.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Replacement form
location /api/ {
proxy_pass http://backend/v1/;
}A request for /api/users is sent upstream as /v1/users. This is correct only if the application expects the /v1/ prefix.
Full-URI form
location /api/ {
proxy_pass http://backend;
}Here, /api/users remains /api/users upstream. A common browser-only symptom occurs when the page uses /api/users, but a server-side curl test calls the backend’s direct /users route. Both requests can return success while testing different application endpoints.
Trailing slashes matter
Compare the exact forms of location /api, location /api/, proxy_pass http://backend, and proxy_pass http://backend/. A missing or added slash changes the replacement boundary and can produce doubled prefixes, missing prefixes, or a backend 404. Confirm the actual upstream URI in application logs rather than inferring it from the browser URL.
Preserve the host when the upstream needs it
By default, NGINX modifies the Host and Connection headers in proxied requests. NGINX’s reverse-proxy documentation specifically notes these two default modifications. If the upstream selects tenants, builds absolute URLs, validates allowed hosts, or issues redirects based on the public name, pass that name explicitly:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemslocation / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://backend;
}Use the headers your application is designed to trust. Forwarded headers do not by themselves make an application secure; configure the application’s trusted-proxy setting and avoid accepting spoofed client IP headers from untrusted networks.
Validate HTTPS, certificates, and TLS/SNI
TLS negotiation occurs before HTTP. If the handshake fails, the browser never sends a request that can appear in the normal NGINX access log. SNI carries the requested hostname during the handshake so a server can choose the correct certificate. A curl command that disables certificate verification is not evidence that a normal browser will accept the endpoint.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Check the certificate in the browser
- Open the certificate details from the browser’s address-bar security indicator.
- Verify that the certificate name covers the exact hostname, including whether a wildcard actually matches that name.
- Check expiration and the complete issuer chain.
- Confirm that port 443 reaches the intended machine and not an old load balancer, development server, or default virtual host.
Also check whether the browser is being redirected from HTTPS to HTTP or to a different port. A certificate can be valid for the first URL while the redirected destination is not.
Use curl without hiding verification errors
curl -v https://example.test/pathThe verbose output shows DNS resolution, connection address, TLS negotiation, certificate verification, request headers, response status, and redirects. Avoid treating curl -k or --insecure as a fix; those options merely suppress curl’s certificate check.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Check protocol assumptions
Confirm that the browser-facing listener and any intermediary support the TLS versions and cipher policy used by current browsers. If a TLS terminator forwards plain HTTP to NGINX, ensure the resulting scheme is communicated to the application with a trusted X-Forwarded-Proto value; otherwise the application may generate an HTTPS-to-HTTP redirect loop.
Trace redirects and session cookies
Inspect every 3xx response, not just the final page. In DevTools, expand the request’s redirect chain. In curl, start without -L:
curl -v https://example.test/loginLook at each Location header for an internal hostname, an HTTP scheme, the wrong port, an unexpected path prefix, or a hostname that is not covered by the certificate. A backend may know itself as http://app:8080 and emit that internal address unless NGINX and the application are configured with the public host and scheme.
Compare cookie attributes
If anonymous pages load but authentication fails, compare the browser’s stored cookies with the response’s Set-Cookie headers. Check:
Recommended Free Tools
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- Domain: a cookie for an internal or unrelated host will not be sent to the public host.
- Secure: a Secure cookie is sent only over HTTPS.
- Path: a cookie scoped to
/appis not sent to an unrelated path. - SameSite: strict cross-site rules can prevent a cookie during a redirected or embedded flow.
- Expiration: an immediately expired cookie can make every request look unauthenticated.
A curl response body can look correct even though the browser rejects a cookie or cannot execute the next redirect. Use the Network panel’s request-cookie and response-cookie views to see what was actually sent.
Resolve mixed-content blocks
A page loaded over HTTPS is not free to fetch every HTTP resource. Browsers can block or upgrade insecure scripts, stylesheets, fonts, images, API calls, and downloads. Curl has no mixed-content policy, so a direct curl to the HTTP resource can succeed while the browser refuses it.
Find the blocked resource
Open the browser Console and locate the mixed-content warning. Then find the corresponding request in Network. Change absolute HTTP URLs to HTTPS, or use same-origin relative URLs such as /api/data when the API is served from the same origin. Ensure generated links, JavaScript configuration, service-worker caches, and redirect targets use the public HTTPS origin.
Do not “fix” a script block by clicking through a browser warning. That weakens transport security and does not solve the configuration error for other users.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Fix same-origin and CORS failures
Browsers define an origin by protocol, host, and port. MDN states that two URLs have the same origin only when those components match. Thus https://app.example.test and https://api.example.test are different origins even when they share a parent domain; changing only the port also creates a different origin.
Recognize a CORS symptom
The API may return a successful status in curl, yet browser JavaScript reports that the response is blocked by CORS. The application server may have produced the data, but the browser will not expose it to script unless the response has an appropriate Access-Control-Allow-Origin value.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Handle preflight requests
For a cross-origin request using non-simple methods or headers, the browser first sends OPTIONS. The preflight must reach NGINX and receive a successful status with headers matching the requested origin, method, and headers. Inspect the preflight separately; a working GET does not prove that the actual browser request is permitted.
Return the exact allowed origin where credentials are involved. Do not combine Access-Control-Allow-Origin: * with credentialed requests. Configure CORS at one deliberate layer—NGINX or the application—and ensure that error responses and preflight responses receive the required headers as well as successful responses.
Verify the policy from the command line
curl -i -X OPTIONS https://api.example.test/data
-H 'Origin: https://app.example.test'
-H 'Access-Control-Request-Method: GET'
-H 'Access-Control-Request-Headers: Authorization, Content-Type'Compare the response with the browser’s preflight request. Header names, methods, origin spelling, and status all matter. A command that omits the Origin header is not a meaningful CORS test.
Use NGINX and upstream logs to locate the failing layer
Logs tell you whether the browser reached NGINX and what NGINX sent onward. Add or temporarily enable fields that identify the selected host, request URI, status, upstream address, origin, and timing. A useful access-log record includes values equivalent to $host, $request_uri, $status, $upstream_addr, and $http_origin.
If there is no access-log entry
- Check DNS resolution from the client network, including an unexpected IPv6 record.
- Check firewall rules, security groups, and whether port 443 is reachable.
- Inspect the browser’s certificate and TLS errors.
- Look for a Console message indicating mixed content or a blocked request that never left the page.
If NGINX logs the request but the upstream does not
Inspect the NGINX error log, upstream address, connect timeout, and proxy routing. A 404 generated by NGINX may indicate a location mismatch; a 502 or 504 usually points to upstream connectivity, name resolution, protocol, or timeout problems. Confirm that the upstream service is listening on the address and protocol NGINX uses.
If both logs show the request
Compare the upstream URI, host, scheme, cookies, authorization headers, and response status. At this point the browser-specific causes are usually redirects, cookie rules, CORS, mixed content, or JavaScript handling rather than basic reachability.
A complete troubleshooting workflow
- Capture the failing request. Save the browser URL, method, status, request headers, response headers, Console error, and redirect chain.
- Run the copied curl command. Use
-vand preserve the same host, scheme, port, path, method, and relevant headers. - Test the public name against the intended IP. Use
--resolveto separate DNS problems from NGINX or application problems. - Verify server selection. Check the listen directive,
server_name, default server, certificate, and SNI name. - Verify path mapping. Calculate the upstream URI produced by
locationandproxy_pass, including trailing slashes. - Verify forwarded context. Confirm the upstream receives the expected host, client-forwarding headers, and original scheme.
- Inspect redirects and cookies. Reject internal destinations, insecure schemes, wrong ports, and cookie domains that do not match the browser host.
- Read browser policy errors. Fix mixed-content URLs, same-origin assumptions, and CORS preflight or response headers.
- Correlate logs. Match the browser timestamp and path across NGINX access/error logs and upstream logs.
- Retest in a clean session. Use a private window or clear the affected site’s cookies and service-worker cache after configuration changes, then confirm the final request—not only the first redirect—succeeds.
Common failed fixes and safer alternatives
| Tempting action | Why it misleads | Safer alternative |
|---|---|---|
Test only 127.0.0.1 |
It bypasses DNS, public Host matching, SNI, and the external firewall. | Test the public hostname and use --resolve when isolating an IP. |
Add -k to curl |
It hides certificate validation errors that browsers still enforce. | Install a valid certificate chain and test with normal verification. |
| Add a wildcard CORS header | It does not authorize credentialed requests and can expose more origins than intended. | Return the exact approved origin and handle preflight explicitly. |
| Change only the backend route | The browser may be hitting a different URI after NGINX replacement. | Log and verify the upstream request URI generated by proxy_pass. |
| Force curl to follow redirects | The final response can hide an incorrect first Location. |
Inspect the first 3xx without -L, then follow deliberately. |
| Disable browser security | It conceals mixed-content and origin defects and is not a user-facing solution. | Serve resources over HTTPS and configure a precise cross-origin policy. |
Configuration verification checklist
- The browser URL uses the intended HTTPS hostname and port.
- DNS resolves that hostname to the intended address for the affected network.
- The 443 listener selects a server block whose
server_namematches the hostname. - The certificate name, chain, and expiration are valid for that hostname.
- The
locationblock maps the browser path to the backend route you expect. - The trailing-slash form of
proxy_passis intentional. - The upstream receives the correct public
Hostand original scheme where required. - Every redirect points to a reachable, correctly secured public URL.
- Cookies have appropriate Domain, Path, Secure, and SameSite attributes.
- No HTTPS page requests an HTTP script, stylesheet, font, API, or download.
- Cross-origin calls return an exact allowed origin and handle
OPTIONSpreflight. - NGINX and upstream logs contain the browser request and agree on status and URI.
What the final diagnosis should contain
When escalating the issue, provide one successful and one failing request with secrets removed, the exact browser Console message, the DevTools request URL and status, the first redirect’s Location, the certificate hostname, the NGINX server block and relevant location/proxy_pass lines, and matching access/error/upstream log entries. This evidence identifies whether the defect is transport, routing, path rewriting, browser policy, or application state instead of treating “curl works” as a single diagnosis.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
