Error map
Session has not been configured InvalidOperationException: Session has not been configured for this application or request
.NET · layer 4, Application & API
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
Warning: session_start(): Session cannot be started after headers have already been sent
session_start() ran after output was sent, so PHP can’t set the session cookie.
Warning: session_start(): open(/var/lib/php/sessions/sess_x, O_RDWR) failed: Permission denied
PHP can’t write session files to the configured session.save_path.
Bearer error="invalid_token": IDX10223: Lifetime validation failed. The token is expired / IDX10501: Signature validation failed
ASP.NET Core’s JwtBearer middleware rejected the token — expired (IDX10223), signature key not found (IDX10501/IDX10503), or wron…
Passport.js: Error: Failed to serialize user into session
Passport logged a user in but there’s no serializeUser function (or it didn’t call done), so the session can’t store the user.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
OIDC Error: login_required / interaction_required / consent_required (silent authentication failed)
A silent sign-in (prompt=none, iframe or refresh) couldn’t complete because the user must interact — no session, consent needed,…
ASP.NET Core: The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time
The CORS policy uses AllowAnyOrigin() together with AllowCredentials(), which browsers forbid.
ASP.NET Core: The antiforgery token could not be decrypted / The required antiforgery cookie is not present (400 Bad Request)
Form POST failed antiforgery validation — the token is missing, the cookie is missing, or Data Protection keys changed so old tok…
InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found
[Authorize] triggered a challenge, but no authentication handler/default scheme is configured.
ForbiddenError: invalid csrf token (EBADCSRFTOKEN)
The request’s CSRF token is missing or doesn’t match the token tied to the user’s session/cookie.
AmbiguousMatchException: The request matched multiple endpoints. Matches: X, Y
Two controller actions or minimal API endpoints have the same route and HTTP method.
Two steps away (35)
Warning: Cannot modify header information - headers already sent
You called `header()`, `setcookie()` or `session_start()` after output had already been sent to the browser.
CORS Error: No 'Access-Control-Allow-Origin' header is present
The browser blocked a cross-origin request because the server’s response didn’t include the CORS headers allowing your site’s ori…
HTTP 411 Length Required
The server refuses a request with a body but no Content-Length header.
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
The docker CLI can’t talk to the Docker engine — it isn’t running, or your user can’t access the socket.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
OAuth 2.0 Error: invalid_scope / insufficient_scope
The requested scope is unknown or not allowed for this client — or the token lacks the scope the API endpoint requires.
Git: Permission denied (publickey). fatal: Could not read from remote repository.
SSH authentication to GitHub/GitLab/Bitbucket failed — no key, wrong key, or the key isn’t added to your account.
Azure AD (Entra ID): AADSTS700016 Application not found in the directory
The client ID in your sign-in request doesn’t exist in the tenant you’re authenticating against.
JWT Expired / Invalid Token
The JSON Web Token sent with the request is expired, malformed or signed with a different key, so the API rejects it (usually wit…
OAuth callback error: state mismatch / Unable to verify authorization request state / State cookie was missing
The state value returned to the callback doesn’t match what the app stored before redirecting — the CSRF protection for OAuth fai…
This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure
The browser refused to store or send an auth/session cookie because of SameSite or Secure rules — so logins don’t “stick” across…
bcrypt error: Illegal arguments: undefined, string / data and salt arguments required / data and hash arguments required
bcrypt.compare/hash received undefined — the password field or stored hash wasn’t passed.
Kubernetes: ImagePullBackOff / ErrImagePull
The node can’t pull the container image — wrong name/tag, missing registry credentials, or registry unreachable.
HTTP 400 Bad Request
The server could not understand the request because its syntax, headers or body are malformed or invalid.
HTTP 407 Proxy Authentication Required
A proxy between you and the server requires credentials before it will forward your request.
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
kubectl: The connection to the server localhost:8080 was refused — did you specify the right host or port?
kubectl has no usable kubeconfig, so it falls back to localhost:8080 — or the cluster API server is unreachable.
AWS: Unable to locate credentials / Could not load credentials from any providers
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.
OAuth 2.0 Error: invalid_grant
The authorization code, refresh token or credentials sent to the token endpoint are invalid, expired, already used or were issued…
HTTP 431 Request Header Fields Too Large
The request headers — almost always cookies — exceed the server’s size limit.
WordPress login: Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.
WordPress’s test cookie wasn’t returned on login — often a siteurl/home or domain mismatch, caching of wp-login.php, or headers a…
Blazor: An unhandled error has occurred. Reload 🗙
A Blazor component threw an exception; Blazor Server tears down the circuit (or WebAssembly logs to the console) and shows the re…
SignalR: Error: Failed to complete negotiation with the server / Failed to start the connection
The SignalR client couldn’t negotiate with the hub — wrong URL, CORS, authentication, or a proxy that blocks WebSockets/negotiate…
Webhook signature verification failed (Stripe, Razorpay, GitHub…)
Your endpoint computed a different HMAC signature than the one the provider sent, so the webhook is rejected.
Laravel: 419 Page Expired (CSRF token mismatch)
Laravel rejected a POST because the CSRF token was missing, expired or didn’t match the session.
Forbidden (403) CSRF verification failed. Request aborted.
Django rejected a POST because the CSRF token was missing, wrong, or the request origin isn’t trusted.
API Error: Invalid API Key / Incorrect API key provided
The API didn’t recognise the key sent with the request — it’s wrong, revoked, from another environment, or sent in the wrong plac…
Azure AD (Entra ID): AADSTS50076 / AADSTS50079 — multi-factor authentication required
A Conditional Access policy requires MFA, but the sign-in flow (often a script, legacy client or ROPC password grant) can’t compl…
InvalidOperationException: Unable to resolve service for type 'X' while attempting to activate 'Y'
ASP.NET Core’s dependency injection container can’t build Y because one of its constructor dependencies (X) was never registered.
Error creating: pods is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false ...
The namespace enforces a Pod Security Standard (baseline/restricted) and the pod spec breaks one of its rules.
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! (ssh host key changed)
The server’s SSH host key differs from the one saved in ~/.ssh/known_hosts — usually because the server was rebuilt or the IP was…
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY
apt can’t verify a repository’s signature because the repo’s signing key isn’t installed (or has expired/rotated).
HTTP 404 Not Found
The server can’t find anything at the requested URL.
HTTP 405 Method Not Allowed
The URL exists, but it doesn’t accept the HTTP method you used (e.g. POST to a GET-only route).
Whitelabel Error Page — This application has no explicit mapping for /error
Spring Boot’s default error page — the request hit no controller mapping (404) or a controller threw (500).
Map another error
Popular: 403500400TypeErrorCritical error0xC000007BNullPointerException404