Error map
antiforgery token could not be decrypted ASP.NET Core: The antiforgery token could not be decrypted / The required antiforgery cookie is not present (400 Bad Request)
.NET · layer 4, Application & API
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
Cloudflare Error 1005: Access denied — The owner of this website has banned the autonomous system number (ASN) your IP address is in
The site owner blocked your network provider (ASN) — common for VPNs, cloud/data-center IPs and some mobile carriers.
Cloudflare Error 1015: You are being rate limited
The site’s Cloudflare rate-limiting rule blocked you for sending too many requests in a short time.
Cloudflare Error 1006 / 1007 / 1008: Access denied — Your IP address has been banned
The site owner (or a Cloudflare security setting) blocked your IP address.
Cloudflare Error 1010: The owner of this website has banned your access based on your browser's signature
Cloudflare’s bot detection blocked the request because its browser fingerprint looks automated.
Cloudflare "Just a moment..." / "Checking your browser" challenge loop (Verify you are human never finishes)
The Cloudflare challenge keeps reloading — the browser can’t pass it because cookies/JavaScript are blocked, the clock is wrong,…
Blazor: An unhandled error has occurred. Reload 🗙
A Blazor component threw an exception; Blazor Server tears down the circuit (or WebAssembly logs to the console) and shows the re…
Cloudflare Error 1011: Access denied (Hotlinking denied)
An image or file is being loaded from another site, and Cloudflare Hotlink Protection blocked it.
API/app requests get 403 with cf-mitigated: challenge (Bot Fight Mode / challenge on non-browser clients)
Cloudflare is answering API calls, webhooks or mobile-app requests with a challenge page (HTML 403) because bot protection treats…
InvalidOperationException: Session has not been configured for this application or request
Code used HttpContext.Session, but session services/middleware aren’t registered — or UseSession runs after the endpoint that nee…
Laravel: 419 Page Expired (CSRF token mismatch)
Laravel rejected a POST because the CSRF token was missing, expired or didn’t match the session.
AADSTS50053: Your account is locked (Smart Lockout) / sign-in blocked due to suspicious activity
Too many failed sign-ins (or sign-ins from a malicious IP) triggered Entra Smart Lockout.
Cloudflare Error 1009: Access denied — The owner of this website has banned the country or region your IP address is in
The site blocks visitors from your country/region.
Two steps away (35)
Webhook signature verification failed (Stripe, Razorpay, GitHub…)
Your endpoint computed a different HMAC signature than the one the provider sent, so the webhook is rejected.
Cloudflare Error 1020: Access Denied
A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…
driver failed programming external connectivity on endpoint: iptables: No chain/target/match by that name
Docker’s iptables rules were wiped (firewalld/ufw reload, iptables flush) while Docker was running, so it can’t publish ports.
AWS: ThrottlingException / Rate exceeded
You exceeded the request rate for an AWS API; retry with exponential backoff.
HTTP 429 Too Many Requests
You’ve hit a rate limit — too many requests in a given time window. Slow down and retry later.
API Error: Too many concurrent requests (concurrency limit reached)
You have more requests in flight at once than the API allows for your key — even if your requests-per-minute rate is fine.
Error creating: pods is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false ...
The namespace enforces a Pod Security Standard (baseline/restricted) and the pod spec breaks one of its rules.
ssh: connect to host x port 22: Connection timed out
SSH packets get no reply — a firewall/security group drops them, the server is off, or the IP is wrong.
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! (ssh host key changed)
The server’s SSH host key differs from the one saved in ~/.ssh/known_hosts — usually because the server was rebuilt or the IP was…
HTTP 418 I'm a teapot
An April Fools’ status from RFC 2324 — some sites and WAFs return it on purpose to tell bots or scrapers to go away.
Nginx 444 No Response (connection closed without response)
An Nginx-specific code: the server deliberately closed the connection without sending anything — a rule is dropping the request.
Cloudflare Error 1012: Access denied
The site owner blocked access with a rule that matched your request (often due to malicious activity detected from your IP).
Cloudflare Turnstile error 110200 / 300030 / 600010 (widget fails to load or verify)
The Turnstile widget couldn’t run or validate — wrong sitekey/domain, blocked scripts, or a client/network issue.
java.lang.SecurityException: Permission Denial ... requires android.permission.X
The app called an API that needs a permission it hasn’t declared or the user hasn’t granted at runtime.
WordPress: 403 Forbidden on wp-admin, wp-login.php or admin-ajax.php
The server or a security layer refused access to WordPress admin URLs — file permissions, a security plugin/WAF rule, ModSecurity…
System.NullReferenceException: Object reference not set to an instance of an object
Code dereferenced a variable that is `null` — the .NET equivalent of Java’s NullPointerException.
CalledFromWrongThreadException: Only the original thread that created a view hierarchy can touch its views
Background code updated a View directly; UI changes must happen on the main thread.
WindowManager$BadTokenException: Unable to add window -- token null is not valid; is your activity running?
A dialog or popup was shown with a context whose Activity is finishing/destroyed, or with the Application context.
Kubernetes: ImagePullBackOff / ErrImagePull
The node can’t pull the container image — wrong name/tag, missing registry credentials, or registry unreachable.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
exec /usr/local/bin/docker-entrypoint.sh: exec format error
The container tried to run a binary built for a different CPU architecture (arm64 vs amd64) — or a script with a broken shebang /…
SyntaxError: Unexpected token < in JSON at position 0
`JSON.parse()` / `response.json()` received something that isn’t JSON — very often an HTML error page.
JWT error: invalid algorithm / The specified alg value is not allowed / jwt signature is required
The token’s alg header doesn’t match the algorithms the verifier allows — e.g. RS256 token verified as HS256, or an unsigned (alg…
ForbiddenError: invalid csrf token (EBADCSRFTOKEN)
The request’s CSRF token is missing or doesn’t match the token tied to the user’s session/cookie.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
Warning: session_start(): Session cannot be started after headers have already been sent
session_start() ran after output was sent, so PHP can’t set the session cookie.
Laravel: No application encryption key has been specified.
Laravel’s APP_KEY is missing, so it can’t encrypt sessions and cookies.
Laravel: Target class [App\Http\Controllers\X] does not exist.
Laravel’s container couldn’t find the controller or class named in a route or binding.
Laravel: SQLSTATE[42S02]: Base table or view not found: 1146 Table 'db.sessions' doesn't exist
Laravel queried a table that hasn’t been created — usually sessions, cache, jobs or a new model’s table.
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY
apt can’t verify a repository’s signature because the repo’s signing key isn’t installed (or has expired/rotated).
SELinux is preventing ... / avc: denied { read } for pid=... (permission denied despite correct permissions)
SELinux blocked the access — file permissions look fine, but the file’s security context or a boolean doesn’t allow the service t…
AADSTS50126: Error validating credentials due to invalid username or password
Microsoft Entra ID (Azure AD) rejected the sign-in because the username or password is wrong — or the flow can’t use passwords fo…
HTTP 451 Unavailable For Legal Reasons
The content is blocked for legal reasons — a court order, government censorship, sanctions, or GDPR geo-blocking.
macOS: “App” is damaged and can’t be opened. You should move it to the Trash.
Gatekeeper blocked an app that isn’t properly signed/notarized or was modified after download (quarantine attribute).
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException