Error map
state mismatch OAuth callback error: state mismatch / Unable to verify authorization request state / State cookie was missing
Authentication · layer 4, Application & API
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
OAuth PKCE error: invalid_grant — PKCE verification failed / code_verifier does not match code_challenge / code_challenge required
The code_verifier sent to the token endpoint doesn’t match the code_challenge from the authorize request, or PKCE is required but…
Passport.js: Error: Failed to serialize user into session
Passport logged a user in but there’s no serializeUser function (or it didn’t call done), so the session can’t store the user.
Firebase Auth: auth/popup-closed-by-user / auth/popup-blocked / auth/cancelled-popup-request
The OAuth popup for Google/GitHub sign-in was closed, blocked by the browser, or replaced by another popup request.
Laravel: 419 Page Expired (CSRF token mismatch)
Laravel rejected a POST because the CSRF token was missing, expired or didn’t match the session.
Forbidden (403) CSRF verification failed. Request aborted.
Django rejected a POST because the CSRF token was missing, wrong, or the request origin isn’t trusted.
WordPress login: Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.
WordPress’s test cookie wasn’t returned on login — often a siteurl/home or domain mismatch, caching of wp-login.php, or headers a…
OIDC Error: login_required / interaction_required / consent_required (silent authentication failed)
A silent sign-in (prompt=none, iframe or refresh) couldn’t complete because the user must interact — no session, consent needed,…
OIDC Error: nonce mismatch / ID token nonce did not match / unexpected nonce
The nonce inside the ID token doesn’t match the one the app stored — the replay protection check failed.
GitHub OAuth: {"error":"bad_verification_code","error_description":"The code passed is incorrect or expired."}
The authorization code sent to GitHub’s token endpoint was already used, expired (10 minutes), or belongs to another OAuth app.
HTTP 431 Request Header Fields Too Large
The request headers — almost always cookies — exceed the server’s size limit.
Google OAuth: Error 401: deleted_client — The OAuth client was deleted
The OAuth client ID used in the request has been deleted from the Google Cloud project.
ForbiddenError: invalid csrf token (EBADCSRFTOKEN)
The request’s CSRF token is missing or doesn’t match the token tied to the user’s session/cookie.
Two steps away (36)
OAuth 2.0 Error: invalid_grant
The authorization code, refresh token or credentials sent to the token endpoint are invalid, expired, already used or were issued…
OAuth 2.0 Error: unsupported_response_type
The authorize request asked for a response_type the client or server doesn’t allow — e.g. token (implicit) when only code is enab…
OAuth 2.0 Error: invalid_request (missing or invalid parameter)
The authorization or token request is malformed — a required parameter is missing, duplicated, or has an invalid value.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
Warning: session_start(): Session cannot be started after headers have already been sent
session_start() ran after output was sent, so PHP can’t set the session cookie.
InvalidOperationException: Session has not been configured for this application or request
Code used HttpContext.Session, but session services/middleware aren’t registered — or UseSession runs after the endpoint that nee…
Azure AD (Entra ID): AADSTS700016 Application not found in the directory
The client ID in your sign-in request doesn’t exist in the tenant you’re authenticating against.
TypeError: Failed to fetch / NetworkError when attempting to fetch resource
The browser couldn’t complete the request at the network level — CORS, DNS, offline, blocked mixed content, or the server refused…
OAuth Error: redirect_uri_mismatch
The redirect URI in your OAuth request doesn’t exactly match one registered for the client in the provider’s console.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Laravel: No application encryption key has been specified.
Laravel’s APP_KEY is missing, so it can’t encrypt sessions and cookies.
Laravel: Target class [App\Http\Controllers\X] does not exist.
Laravel’s container couldn’t find the controller or class named in a route or binding.
Python was not found; run without arguments to install from the Microsoft Store
Windows ran the Microsoft Store “App execution alias” instead of a real Python installation.
django.db.utils.OperationalError: no such table: app_model
Django queried a table that hasn’t been created — migrations missing or not applied.
django.core.exceptions.ImproperlyConfigured: settings are not configured / SECRET_KEY must not be empty
Django can’t load its settings — DJANGO_SETTINGS_MODULE unset, a required setting missing, or an environment variable not provide…
Warning: Cannot modify header information - headers already sent
You called `header()`, `setcookie()` or `session_start()` after output had already been sent to the browser.
WordPress: ERR_TOO_MANY_REDIRECTS / redirected you too many times on wp-admin or the whole site
WordPress and the server/proxy keep redirecting to each other — usually siteurl/home mismatch (http vs https, www vs non-www) or…
WordPress: 404 Not Found on every page except the homepage (permalinks / .htaccess / Nginx rules)
Pretty permalinks aren’t being routed to index.php — .htaccess is missing/ignored (Apache) or Nginx lacks try_files.
Warning: session_start(): open(/var/lib/php/sessions/sess_x, O_RDWR) failed: Permission denied
PHP can’t write session files to the configured session.save_path.
OAuth 2.0 Error: access_denied (The user or authorization server denied the request)
The authorization request was refused — the user clicked Cancel/Deny on the consent screen, or a policy denied access.
This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure
The browser refused to store or send an auth/session cookie because of SameSite or Secure rules — so logins don’t “stick” across…
Webhook signature verification failed (Stripe, Razorpay, GitHub…)
Your endpoint computed a different HMAC signature than the one the provider sent, so the webhook is rejected.
invalid_token: The access token is invalid (JsonWebTokenError: invalid signature / jwt malformed)
A token was sent but the server couldn’t verify it — bad signature, malformed, revoked, or issued for another audience or environ…
java.lang.SecurityException: Permission Denial ... requires android.permission.X
The app called an API that needs a permission it hasn’t declared or the user hasn’t granted at runtime.
OAuth 2.0 Error: invalid_client
The OAuth server couldn’t authenticate your application — wrong client ID/secret, wrong auth method, or the client doesn’t exist…
OAuth 2.0 Error: invalid_scope / insufficient_scope
The requested scope is unknown or not allowed for this client — or the token lacks the scope the API endpoint requires.
AADSTS500113: No reply address is registered for the application
The app registration has no redirect URI for the platform being used, so Entra ID has nowhere to send the response.
HTTP 400 Bad Request
The server could not understand the request because its syntax, headers or body are malformed or invalid.
HTTP 413 Content Too Large (Request Entity Too Large)
The request body is bigger than the server is willing to accept — usually a file upload over the configured limit.
HTTP 414 URI Too Long
The request URL (usually the query string) is longer than the server will accept.
OAuth 2.0 Error: unauthorized_client (client not allowed to use this grant type)
The client exists, but isn’t allowed to use the requested flow (grant type or response type).
OAuth 2.0 Error: unsupported_grant_type
The token endpoint didn’t recognise grant_type — usually because the body wasn’t sent as application/x-www-form-urlencoded, or th…
Google OAuth: Error 403: access_denied — The developer hasn't given you access to this app / has not completed the Google verification process
The Google OAuth app is in “Testing” publishing status and the signing-in account isn’t listed as a test user.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
Error creating: pods is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false ...
The namespace enforces a Pod Security Standard (baseline/restricted) and the pod spec breaks one of its rules.
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! (ssh host key changed)
The server’s SSH host key differs from the one saved in ~/.ssh/known_hosts — usually because the server was rebuilt or the IP was…
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException