💡 Practical Experience

The Trailing Slash in proxy_pass

This is one of the classic Nginx traps: proxy_pass http://backend and proxy_pass http://backend/ behave differently. Without the trailing slash, the original URI is passed through as-is. With the trailing slash, the part matched by location is replaced. Many people lose an afternoon to this.

Run nginx -t Before Changing Live Config

If you edit the config and immediately run nginx -s reload, a syntax error usually makes the reload fail. The old workers may keep serving traffic, but your new configuration will not take effect; worse, a later restart may fail completely. Use a three-step habit: nginx -t to check syntax, read the error, then nginx -s reload.

try_files Saves SPAs

Vue and React single-page apps using history mode often return 404 after a page refresh because the server cannot find a matching HTML file. Add try_files $uri $uri/ /index.html; and the app can route the request on the client side.

Do Not Name an Upstream localhost

upstream localhost { ... } looks harmless, but Nginx treats localhost as a name to resolve, which may lead to an unexpected IP. Use a meaningful upstream name instead: upstream api_backend { ... }.

Remember server_tokens off

By default, Nginx exposes its version in response headers and error pages, for example Server: nginx/1.25.3. Once attackers know the version, they can look for known vulnerabilities. One line fixes it: server_tokens off;.