DIAGNOSTIC TREE // CORS-PROXY-LAN-403 (3 ROOT CAUSES)

Browser Extension / LAN Client Gets HTTP 403 (CORS) or 502 Calling Local Ollama

Diagnose OLLAMA_ORIGINS rejections, Host header mismatches behind Nginx/Caddy, and mixed-content HTTPS->HTTP blocks.

[KEY VERIFIED TAKEAWAY / TL;DR]This diagnostic decision tree for "Browser Extension / LAN Client Gets HTTP 403 (CORS) or 502 Calling Local Ollama" provides 4 interactive nodes and 3 hardware-verified root-cause fixes (Fix: Configure OLLAMA_ORIGINS to Whitelist Browser Extensions & WebUIs; Fix: Rewrite Host Header to localhost:11434 in Reverse Proxy; Fix: Terminate Local TLS via Caddy/Tailscale or Route via Server Backend), paired with our reproducible guide "cors-reverse-proxy-auth-local-llm".

Step 1: What Exact Error Appears in Browser DevTools (Network Tab)?

Reproduce the failed request or simulate a browser Origin header with the curl command below.

Diagnostic Probe Command

curl -i -X OPTIONS http://127.0.0.1:11434/api/tags -H "Origin: chrome-extension://test" -H "Access-Control-Request-Method: POST"

If Ollama returns HTTP/1.1 403 Forbidden, its built-in Origin whitelist rejected the caller.

Select what your environment outputs:

DIAGNOSTIC PROBE SEQUENCE // 完整分步探测命令与症状分支

All 1 Terminal Diagnostic Probes in "Browser Extension / LAN Client Gets HTTP 403 (CORS) or 502 Calling Local Ollama"

Complete static reference of every read-only probe command, baseline hint, and branch transition in this decision tree.

Step 1: What Exact Error Appears in Browser DevTools (Network Tab)?step-cors-status

Reproduce the failed request or simulate a browser Origin header with the curl command below.

curl -i -X OPTIONS http://127.0.0.1:11434/api/tags -H "Origin: chrome-extension://test" -H "Access-Control-Request-Method: POST"

If Ollama returns HTTP/1.1 403 Forbidden, its built-in Origin whitelist rejected the caller.

Symptom Branches:

• Returns HTTP 403 Forbidden on OPTIONS or POST→ sol-ollama-origins-env
• Returns 403/502 only when accessed through Nginx / Caddy reverse proxy→ sol-proxy-host-header-rewrite
• Browser blocks request before sending (Mixed Content: HTTPS page -> HTTP LAN IP)→ sol-mixed-content-https

ALL VERIFIED FIXES IN THIS TREE // 本树涵盖的全部根因与修复方案一览

3 Verified Root Causes, Fix Configs & Commands in "Browser Extension / LAN Client Gets HTTP 403 (CORS) or 502 Calling Local Ollama"

Fix: Configure OLLAMA_ORIGINS to Whitelist Browser Extensions & WebUIs

sol-ollama-origins-env

Ollama rejects browser requests carrying an Origin header other than localhost unless explicitly listed in OLLAMA_ORIGINS (to prevent malicious websites from querying your local models via CSRF).

Set OLLAMA_ORIGINS="chrome-extension://*,moz-extension://*,http://192.168.*" (or "*" on a trusted loopback/proxy setup).
Restart the Ollama service and verify the OPTIONS preflight returns 200/204.

# macOS (launchctl)
launchctl setenv OLLAMA_ORIGINS "chrome-extension://*,moz-extension://*,http://localhost:*"

# Linux systemd override (/etc/systemd/system/ollama.service.d/override.conf)
[Service]
Environment="OLLAMA_ORIGINS=chrome-extension://*,moz-extension://*,http://192.168.*"

[BOUNDARY]Avoid setting OLLAMA_ORIGINS="*" at the same time as OLLAMA_HOST="0.0.0.0" without an auth proxy, or any website you visit can invoke your local LLM.

Verify:

curl -i -X OPTIONS http://127.0.0.1:11434/api/tags -H "Origin: chrome-extension://test" -H "Access-Control-Request-Method: POST"

Fix: Rewrite Host Header to localhost:11434 in Reverse Proxy

sol-proxy-host-header-rewrite

Recent Ollama versions validate the HTTP Host header against DNS rebinding attacks. If Nginx forwards Host: ai.homelab.local, Ollama returns 403.

Keep Ollama bound strictly to 127.0.0.1:11434.
Add `proxy_set_header Host localhost:11434;` in Nginx (or `header_up Host localhost:11434` in Caddy).

location / {
    proxy_pass http://127.0.0.1:11434;
    proxy_set_header Host localhost:11434;
    proxy_buffering off;
    proxy_read_timeout 300s;
}

[BOUNDARY]Combine with Bearer token checks in Nginx so LAN users must authenticate.

Verify: curl -i http://127.0.0.1:11434/api/version -H "Host: localhost:11434"

Fix: Terminate Local TLS via Caddy/Tailscale or Route via Server Backend

sol-mixed-content-https

Modern browsers strictly block HTTPS web apps from making fetch() calls to plain HTTP LAN addresses (e.g. http://192.168.1.50:11434), except http://127.0.0.1.

If the client is a containerized web app (Open WebUI / LobeChat), configure the Ollama URL in its server-side backend environment rather than browser-direct mode.
Or expose the LAN endpoint over HTTPS using Caddy internal TLS / Tailscale Serve.

# Caddyfile with automatic local TLS & Host rewrite
https://ollama.homelab.internal {
    tls internal
    reverse_proxy 127.0.0.1:11434 {
        header_up Host localhost:11434
        flush_interval -1
    }
}

[BOUNDARY]`http://127.0.0.1` is treated as a Secure Context by browsers, whereas `http://192.168.x.x` is not.

Verify: caddy validate --config Caddyfile

PAIRED REPRODUCIBLE GUIDE // 配套实测指南与硬件环境基线

Fixing Local LLM HTTP 403 CORS, Reverse Proxy Host Headers & LAN Bearer Authentication

Why browser extensions and LAN web clients get HTTP 403 Forbidden from Ollama—and how to configure OLLAMA_ORIGINS, Host header rewrites, and Bearer token protection safely.

Paired Config Artifact →Read Full Verified Guide →

TESTED HARDWARE & OS

Nginx 1.26 / Caddy 2.8 · Ollama 0.5.7 · Chrome / Firefox Extensions & LAN Web Clients

PINNED STACK VERSIONS

Ollama 0.5.7 · Nginx 1.26+ · Caddy 2.8+

VERIFIED (2026-10-23)

100% Intranet / LAN Authenticated Gateway — Keeps raw Ollama bound strictly to 127.0.0.1 while exposing a Bearer-authenticated port to trusted LAN devices.