Error map

Failed to serialize user into session Passport.js: Error: Failed to serialize user into session

Authentication · layer 4, Application & API

Centre: this error. First ring: errors it is linked with (8). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.

1 · On your device 2 · Network 4 · Application & API 6 · Platform & cloud

Directly related (8)

session_start()PHP

Warning: session_start(): Session cannot be started after headers have already been sent

session_start() ran after output was sent, so PHP can’t set the session cookie.

Session has not been configured.NET

InvalidOperationException: Session has not been configured for this application or request

Code used HttpContext.Session, but session services/middleware aren’t registered — or UseSession runs after the endpoint that nee…

ExpiredTokenAWS

AWS: ExpiredToken — The security token included in the request is expired

Temporary AWS credentials (STS/SSO/assumed role) have expired.

login_requiredAuthentication

OIDC Error: login_required / interaction_required / consent_required (silent authentication failed)

A silent sign-in (prompt=none, iframe or refresh) couldn’t complete because the user must interact — no session, consent needed,…

state mismatchAuthentication

OAuth callback error: state mismatch / Unable to verify authorization request state / State cookie was missing

The state value returned to the callback doesn’t match what the app stored before redirecting — the CSRF protection for OAuth fai…

Illegal arguments: undefined, stringAuthentication

bcrypt error: Illegal arguments: undefined, string / data and salt arguments required / data and hash arguments required

bcrypt.compare/hash received undefined — the password field or stored hash wasn’t passed.

invalid csrf tokenAuthentication

ForbiddenError: invalid csrf token (EBADCSRFTOKEN)

The request’s CSRF token is missing or doesn’t match the token tied to the user’s session/cookie.

SameSite cookie blockedAuthentication

This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure

The browser refused to store or send an auth/session cookie because of SameSite or Secure rules — so logins don’t “stick” across…

Two steps away (24)

401HTTP

HTTP 401 Unauthorized

The request has no valid authentication credentials — you need to log in or send a valid token.

Headers already sentPHP

Warning: Cannot modify header information - headers already sent

You called `header()`, `setcookie()` or `session_start()` after output had already been sent to the browser.

CORSAPI

CORS Error: No 'Access-Control-Allow-Origin' header is present

The browser blocked a cross-origin request because the server’s response didn’t include the CORS headers allowing your site’s ori…

session save pathPHP

Warning: session_start(): open(/var/lib/php/sessions/sess_x, O_RDWR) failed: Permission denied

PHP can’t write session files to the configured session.save_path.

CORS wildcard with credentials.NET

ASP.NET Core: The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time

The CORS policy uses AllowAnyOrigin() together with AllowCredentials(), which browsers forbid.

The request matched multiple endpoints.NET

AmbiguousMatchException: The request matched multiple endpoints. Matches: X, Y

Two controller actions or minimal API endpoints have the same route and HTTP method.

AccessDeniedAWS

AWS S3: AccessDenied (403) when calling GetObject / PutObject

An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.

kubectl connection refusedKubernetes

kubectl: The connection to the server localhost:8080 was refused — did you specify the right host or port?

kubectl has no usable kubeconfig, so it falls back to localhost:8080 — or the cluster API server is unreachable.

NoCredentialsErrorAWS

AWS: Unable to locate credentials / Could not load credentials from any providers

The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.

invalid_grantAuthentication

OAuth 2.0 Error: invalid_grant

The authorization code, refresh token or credentials sent to the token endpoint are invalid, expired, already used or were issued…

431HTTP

HTTP 431 Request Header Fields Too Large

The request headers — almost always cookies — exceed the server’s size limit.

Cookies are blockedWordPress

WordPress login: Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.

WordPress’s test cookie wasn’t returned on login — often a siteurl/home or domain mismatch, caching of wp-login.php, or headers a…

419 Page ExpiredPHP

Laravel: 419 Page Expired (CSRF token mismatch)

Laravel rejected a POST because the CSRF token was missing, expired or didn’t match the session.

Django CSRFPython

Forbidden (403) CSRF verification failed. Request aborted.

Django rejected a POST because the CSRF token was missing, wrong, or the request origin isn’t trusted.

PKCE verification failedAuthentication

OAuth PKCE error: invalid_grant — PKCE verification failed / code_verifier does not match code_challenge / code_challenge required

The code_verifier sent to the token endpoint doesn’t match the code_challenge from the authorize request, or PKCE is required but…

parameter_missingAPI