Certificate validation often breaks first, since the TLS cert may not match the forwarded host, causing browser warnings or failed handshakes. HSTS rules can also interfere, forcing HTTPS on a domain that no longer serves it correctly. Cookies tied to strict domains may stop sending, and CORS policies can block requests after redirects. WebSockets using wss can drop if the new host isn't configured. Even 301/302 redirects may strip POST bodies or downgrade security context. Tracking these patterns in logs helps identify where trust chains or session continuity fail during forwarding.