Defining location /files { alias /var/www/files/; } without a trailing slash on the location path allows attackers to request /files../config.json. Nginx strips /files, leaving ../config.json appended to /var/www/files/, allowing the attacker to read files in the parent directory.

Hardcoding a domain name in proxy_pass https://api.example.com; evaluates DNS once at boot. When cloud load balancers rotate IPs, Nginx continues sending traffic to the defunct IP address, generating 502 Bad Gateway errors. Storing the target in a variable (set $backend ...; proxy_pass $backend;) with an active resolver directive forces dynamic DNS refreshing.

Without keepalive 32; in the upstream block and proxy_set_header Connection "";, Nginx closes the backend socket after every HTTP request. High-traffic servers cycle through all 65,535 local TCP ports in minutes, stalling the proxy in TIME_WAIT state and throwing connection reset errors.

Using proxy_set_header Host $http_host; forwards whatever raw Host header the client supplied, allowing attackers to inject arbitrary hostnames to poison downstream caches or generate malicious password reset emails. Always use $host, which falls back to the declared server_name.

Using return 301 https://$host$uri; in HTTP-to-HTTPS redirects is dangerous because $uri is decoded by Nginx. If an attacker sends encoded CRLF characters (%0d%0a), Nginx decodes them and emits a response splitting attack. Modern configs must use return 301 https://$host$request_uri;, preserving raw encoding.