Error map
CORS wildcard with credentials ASP.NET Core: The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time
.NET · layer 4, Application & API
Centre: this error. First ring: errors it is linked with (8). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (8)
CORS Error: No 'Access-Control-Allow-Origin' header is present
The browser blocked a cross-origin request because the server’s response didn’t include the CORS headers allowing your site’s ori…
Bearer error="invalid_token": IDX10223: Lifetime validation failed. The token is expired / IDX10501: Signature validation failed
ASP.NET Core’s JwtBearer middleware rejected the token — expired (IDX10223), signature key not found (IDX10501/IDX10503), or wron…
Blazor: An unhandled error has occurred. Reload 🗙
A Blazor component threw an exception; Blazor Server tears down the circuit (or WebAssembly logs to the console) and shows the re…
InvalidOperationException: Session has not been configured for this application or request
Code used HttpContext.Session, but session services/middleware aren’t registered — or UseSession runs after the endpoint that nee…
SignalR: Error: Failed to complete negotiation with the server / Failed to start the connection
The SignalR client couldn’t negotiate with the hub — wrong URL, CORS, authentication, or a proxy that blocks WebSockets/negotiate…
ASP.NET Core: The antiforgery token could not be decrypted / The required antiforgery cookie is not present (400 Bad Request)
Form POST failed antiforgery validation — the token is missing, the cookie is missing, or Data Protection keys changed so old tok…
InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found
[Authorize] triggered a challenge, but no authentication handler/default scheme is configured.
AmbiguousMatchException: The request matched multiple endpoints. Matches: X, Y
Two controller actions or minimal API endpoints have the same route and HTTP method.
Two steps away (23)
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Git: Permission denied (publickey). fatal: Could not read from remote repository.
SSH authentication to GitHub/GitLab/Bitbucket failed — no key, wrong key, or the key isn’t added to your account.
Azure AD (Entra ID): AADSTS700016 Application not found in the directory
The client ID in your sign-in request doesn’t exist in the tenant you’re authenticating against.
JWT Expired / Invalid Token
The JSON Web Token sent with the request is expired, malformed or signed with a different key, so the API rejects it (usually wit…
System.NullReferenceException: Object reference not set to an instance of an object
Code dereferenced a variable that is `null` — the .NET equivalent of Java’s NullPointerException.
CalledFromWrongThreadException: Only the original thread that created a view hierarchy can touch its views
Background code updated a View directly; UI changes must happen on the main thread.
WindowManager$BadTokenException: Unable to add window -- token null is not valid; is your activity running?
A dialog or popup was shown with a context whose Activity is finishing/destroyed, or with the Application context.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
Warning: session_start(): Session cannot be started after headers have already been sent
session_start() ran after output was sent, so PHP can’t set the session cookie.
Warning: session_start(): open(/var/lib/php/sessions/sess_x, O_RDWR) failed: Permission denied
PHP can’t write session files to the configured session.save_path.
WebSocket connection to 'wss://x' failed
The browser couldn’t open (or keep) a WebSocket connection.
ObjectDisposedException: Cannot access a disposed context instance
Code used a DbContext after its scope ended — usually async void, fire-and-forget tasks, or capturing a scoped context in a singl…
Webhook signature verification failed (Stripe, Razorpay, GitHub…)
Your endpoint computed a different HMAC signature than the one the provider sent, so the webhook is rejected.
Laravel: 419 Page Expired (CSRF token mismatch)
Laravel rejected a POST because the CSRF token was missing, expired or didn’t match the session.
Forbidden (403) CSRF verification failed. Request aborted.
Django rejected a POST because the CSRF token was missing, wrong, or the request origin isn’t trusted.
OAuth 2.0 Error: invalid_grant
The authorization code, refresh token or credentials sent to the token endpoint are invalid, expired, already used or were issued…
API Error: Invalid API Key / Incorrect API key provided
The API didn’t recognise the key sent with the request — it’s wrong, revoked, from another environment, or sent in the wrong plac…
Azure AD (Entra ID): AADSTS50076 / AADSTS50079 — multi-factor authentication required
A Conditional Access policy requires MFA, but the sign-in flow (often a script, legacy client or ROPC password grant) can’t compl…
HTTP 404 Not Found
The server can’t find anything at the requested URL.
HTTP 405 Method Not Allowed
The URL exists, but it doesn’t accept the HTTP method you used (e.g. POST to a GET-only route).
Whitelabel Error Page — This application has no explicit mapping for /error
Spring Boot’s default error page — the request hit no controller mapping (404) or a controller threw (500).
Map another error
Popular: 403500400TypeErrorCritical error0xC000007BNullPointerException404