Nginx Works With curl but Not in the Browser: How to Fix It

If an NGINX endpoint answers with curl but fails in Chrome or Firefox, the server is not necessarily healthy for the browser request. The two clients may use a different hostname, scheme, port, path, headers, redirect flow, TLS handshake, cookies, or browser security policy. Reproduce the exact failing request, then isolate transport, NGINX routing, proxy path rewriting, browser policy, and application state in that order.

Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.

What a successful curl response does—and does not—prove

A response from curl proves only that one HTTP client completed one request under one set of conditions. It does not prove that a browser can resolve the same hostname, negotiate the same TLS connection, select the same NGINX server block, follow the same redirects, send the same headers, or permit the resulting page and scripts to run.

#	Preview	Product	Price
1		Gaoye Blue Light Blocking Glasses | Anti UV Ray, For Computers & Gaming, Square Frame, Eyewear for...	$9.99	Buy on Amazon
2		Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and...	$6.59	Buy on Amazon
3		LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men | Office Gifts for Women,...	$9.95	Buy on Amazon
4		Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack	$9.99	Buy on Amazon
5		HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″...	$57.99	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

Browsers also add behavior that a basic curl command does not: they enforce same-origin policy, block insecure mixed content, perform CORS preflights, store and filter cookies, execute JavaScript, and can follow redirects initiated by a script or a meta tag. A curl response body can therefore look correct while the browser still reports a network error, a certificate warning, a blocked request, or a blank application.

Start by making the requests identical

Copy the browser request from DevTools

1. Open the page in the browser and press F12 (or open Developer Tools from the browser menu).
2. Select the Network panel, reload the page, and select the request that fails. Include the document request, API call, script, stylesheet, font, image, or download that shows the problem.
3. Use the request’s context menu and choose Copy as cURL. This captures the browser’s actual URL, method, query string, request headers, and, when relevant, cookies.
4. Run the copied command in a terminal, then compare it with your original command. Keep the same hostname, scheme, port, path, method, and request body while testing one variable at a time.

The copied command is a diagnostic baseline, not a permanent production command. It may contain session cookies or authorization data, so treat it as sensitive.

#1 Best Overall

Sale

Gaoye Blue Light Blocking Glasses | Anti UV Ray, For Computers & Gaming, Square Frame, Eyewear for Men and Women

• BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
• EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
• COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
• LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
• WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.

$9.99

Buy on Amazon

Use verbose and header-only tests deliberately

Run curl -v against the exact public URL to see DNS resolution, the connection address, TLS negotiation, request headers, response status, and response headers. Use curl -I to inspect headers without downloading the response body. If redirects are part of the expected flow, add -L explicitly. curl does not automatically perform every redirect that a browser can trigger through JavaScript or an HTML meta tag.

Do not compare a browser request to a shortcut such as curl http://127.0.0.1 when the page uses https://app.example.test/api. A loopback request can select another NGINX server block, bypass public DNS, use another port, and send a different Host value.

Identify the failing layer

Work from the lowest layer upward. The first layer that differs explains why a result that works in curl fails in the browser.

Verify NGINX selected the intended server block

Use the public hostname, not only localhost

NGINX chooses a server block using the address and port from listen and the request’s Host value against server_name. If no name matches, NGINX sends the request to the default server for that address and port. A curl test to an upstream IP or 127.0.0.1 can therefore succeed while the browser reaches a different block through public DNS.

Test the production hostname while forcing a known address with:

curl -v --resolve example.test:443:IP https://example.test/path

Replace IP with the address you intend to test. The command keeps the hostname in the URL and TLS SNI while directing the TCP connection to the selected address. Compare its response with the browser’s request and with the certificate presented on port 443.

Rank #2

Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)

• WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
• AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
• PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
• ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
• COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed

$6.59

Buy on Amazon

Check DNS, address families, and ports

Confirm that the browser’s hostname resolves to the expected public address. An IPv6 record can send the browser to an IPv6 listener while a curl test uses IPv4, or a browser can use port 443 while a manual test uses port 80. Test each scheme and port explicitly, and inspect the Network panel’s request URL rather than relying on what you intended to type.

Check location and proxy_pass URI rewriting

The URI form of proxy_pass changes what the upstream receives. When proxy_pass includes a URI, NGINX replaces the portion of the normalized request URI that matched the location. When it has no URI, NGINX forwards the full request URI.

For example, a browser request to /api/users can reach the upstream as a different path if the matching location uses a URI-bearing proxy definition. The backend may then return 404 even though a curl test against the backend’s expected path works. Test the exact browser path, including a trailing slash, query string, and URL-encoded characters, and verify the route recorded by the upstream.

Keep the public host when the upstream uses host-based routing or generates absolute URLs:

location /api/ {
    proxy_set_header Host $host;
    proxy_pass http://backend;
}

This example illustrates the header setting; adapt the location and upstream to your configuration. By default, NGINX modifies the proxied Host and Connection headers. If the upstream expects the public hostname, set proxy_set_header Host $host explicitly and reload NGINX after validating the configuration.

Compare the route at three points

• The URL shown in the browser Network panel.
• The $request_uri and $host values in the NGINX access log.
• The path and host observed by the upstream application.

A mismatch between these points identifies whether the browser sent an unexpected URL, NGINX matched another location, or proxying changed the route.

Rank #3

Sale

LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men | Office Gifts for Women, iPhone Stand, Gadgets for Men, Office Decor, Gaming Desk Accessories for Samsung Fold 8, Switch, iPad

• Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
• Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
• Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
• ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
• Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)

$9.95

Buy on Amazon

Resolve HTTPS, certificates, and TLS/SNI failures

TLS negotiation occurs before HTTP. The browser must establish a valid HTTPS connection and verify the certificate before it can send the request that appears in your application logs. Server Name Indication (SNI) tells the TLS endpoint which hostname the client wants; a wrong certificate or wrong port can stop the exchange before NGINX processes an HTTP request.

Inspect the certificate the browser actually receives

• Confirm that the certificate name covers the exact hostname, including any subdomain.
• Check the certificate’s expiration date and trust chain.
• Verify that port 443 reaches the intended NGINX instance rather than a default virtual host or another service.
• Compare the browser’s security details with the certificate returned by a verbose curl request to the same hostname.

A curl command run with certificate verification disabled only demonstrates that an encrypted connection was possible when validation was bypassed. It is not evidence that a normal browser will accept the certificate.

Separate TLS errors from HTTP errors

If the browser shows a certificate warning and no request appears in NGINX’s access log, fix DNS, the port, the certificate, or SNI first. If the browser completes TLS and the request is logged, move on to server selection, proxying, and application behavior instead of changing certificate settings blindly.

Follow every redirect and inspect its target

Look at each 3xx response and its Location header in the Network panel. A redirect can point to an internal hostname, the wrong scheme, the wrong port, or a path that NGINX rewrites differently. A public HTTPS request that redirects to HTTP can also become a mixed-content or security failure.

Run curl with -L when you want to follow ordinary HTTP redirects, but still compare every hop with the browser. Browsers may execute a JavaScript redirect or an HTML meta refresh that curl will not perform automatically. A successful first response is therefore not proof that the final browser URL is reachable.

When only login fails, inspect cookies

If an unauthenticated page loads but a session does not persist, compare the browser’s stored cookies with the response’s Set-Cookie attributes. Check the cookie domain, the Secure flag, and SameSite behavior against the scheme and host used by the browser. A cookie scoped to an internal hostname, or a cookie marked Secure while the flow uses HTTP, can make a proxy appear broken even when its response body is correct.

Rank #4

Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack

• Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
• Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
• 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
• Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
• USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC

$9.99

Buy on Amazon

Fix mixed-content blocks

A page loaded over HTTPS cannot freely load insecure HTTP resources. Browsers can block or upgrade HTTP scripts, stylesheets, fonts, API calls, and downloads. curl has no equivalent page security policy, so it can retrieve the HTTP URL successfully while the browser refuses to use it.

Read the exact warning in the browser Console and inspect the blocked request’s URL. Change resource URLs to HTTPS, or use same-origin relative URLs such as /api/data when the resource is served from the same origin. Then reload and confirm that the request appears as HTTPS in the Network panel.

Handle same-origin policy and CORS preflight

Determine whether the origins differ

Two URLs have the same origin only when their protocol, host, and (when specified) port are the same. Changing any one of those components makes a frontend request cross-origin. A page at one hostname calling an API through another hostname, scheme, or port is therefore subject to browser CORS checks even if both names resolve to the same machine.

Inspect the failing fetch or XMLHttpRequest in DevTools. If the Console reports a CORS or same-origin error and the request reaches NGINX, this is a browser policy problem rather than proof that the upstream is down.

Return matching CORS headers

The response must include an exact Access-Control-Allow-Origin value for the requesting origin, plus any required methods and request headers. For requests that carry credentials, do not use Access-Control-Allow-Origin: *; return the specific allowed origin and configure credential handling consistently.

Answer the browser’s OPTIONS preflight

Non-simple methods or headers can cause the browser to send an OPTIONS preflight before the real request. Ensure NGINX or the upstream returns a successful status for that preflight and includes matching CORS headers. Check the preflight separately in the Network panel: a successful curl request using the final method does not prove that the browser’s preceding OPTIONS request succeeds.

Best Value

Sale

HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs

• Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
• Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
• Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
• Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
• Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.

$57.99

Buy on Amazon

Use logs to locate the boundary

When the browser request is absent

If no corresponding entry exists in the NGINX access log, the request did not reach HTTP handling. Investigate DNS, connectivity, the selected port, TLS certificate and SNI, mixed-content blocking, or a browser policy that prevented the request from being sent.

When the request is present

Correlate the access-log status with the error log and upstream logs. Record the request’s $host, $request_uri, upstream address, and $http_origin. These fields reveal whether NGINX selected the expected hostname, forwarded the expected path, received a cross-origin request, and obtained a response from the intended backend.

A 4xx or 5xx in the access log moves the investigation to NGINX routing, proxying, or the application. A 2xx response paired with a browser error points toward response headers, CORS, mixed content, cookies, or client-side code rather than basic reachability.

A complete troubleshooting sequence

1. Record the browser failure. Save the failing URL, method, status shown in Network, and the first relevant Console message.
2. Copy the request as cURL. Run it, then run curl -v and, for headers, curl -I against the same hostname, scheme, port, and path.
3. Follow redirects intentionally. Repeat with -L and compare every Location target with the browser’s redirect chain.
4. Test server selection. Use the public hostname and, when necessary, --resolve to pin the intended address while retaining the correct Host and SNI.
5. Verify TLS. Check certificate name, chain, expiration, protocol negotiation, and the service listening on port 443.
6. Verify NGINX routing. Compare server_name, listen, Host, matching location, and the proxy path.
7. Verify upstream headers. If the application depends on the public hostname, set proxy_set_header Host $host and confirm what the upstream receives.
8. Check browser policy. Resolve mixed-content warnings, CORS headers, and the OPTIONS preflight before changing application code.
9. Check stateful behavior. Compare redirect destinations and cookie domain, Secure, and SameSite attributes when only authentication or sessions fail.
10. Correlate logs. Use access, error, and upstream logs to identify the first layer where the browser request differs or disappears.

Common symptoms and the most likely next check

Configuration and testing mistakes to avoid

• Do not conclude that the upstream is healthy because a request to its IP works; the browser may be using a different virtual host and certificate.
• Do not “fix” a browser certificate error by disabling verification in curl. Correct the certificate, chain, hostname, or listener.
• Do not assume a successful first 3xx response is the final result. Inspect every redirect destination.
• Do not add a wildcard CORS origin to credentialed requests. Match the actual requesting origin instead.
• Do not diagnose a proxy path without checking the trailing slash and the URI portion of proxy_pass.
• Do not rely on an NGINX access log alone for a TLS failure; TLS can fail before an HTTP request exists.
• Do not treat a curl response body as evidence that browser JavaScript, cookies, or security policy will accept the response.

When the fix is confirmed

Retest from a clean browser reload and keep the DevTools Network panel open. The final request should show the intended HTTPS URL, the expected host and path, a valid status, and no blocked subrequests. The Console should be free of certificate, mixed-content, and CORS errors. NGINX access logs should show the same host and URI you tested with curl, and the upstream should receive the route and host it expects.

Only after those checks agree should you remove temporary diagnostics such as forced DNS resolution or verbose logging. The durable fix is the one that makes the browser’s complete request—transport, routing, path, policy, and state—match the request you originally proved with curl.

Quick Recap

SaleBestseller No. 1

Gaoye Blue Light Blocking Glasses | Anti UV Ray, For Computers & Gaming, Square Frame, Eyewear for Men and Women

$9.99

Bestseller No. 2

Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)

$6.59

SaleBestseller No. 3

LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men | Office Gifts for Women, iPhone Stand, Gadgets for Men, Office Decor, Gaming Desk Accessories for Samsung Fold 8, Switch, iPad

$9.95

Bestseller No. 4

Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack

$9.99

SaleBestseller No. 5

HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs

$57.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.