Error map
blocked a frame SecurityError: Blocked a frame with origin "x" from accessing a cross-origin frame.
JavaScript · layer 1, On your device
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
CORS Error: No 'Access-Control-Allow-Origin' header is present
The browser blocked a cross-origin request because the server’s response didn’t include the CORS headers allowing your site’s ori…
Error: A cross-origin error was thrown. React doesn't have access to the actual error object in development.
An error happened in a script loaded from another origin, so the browser hid the details from React.
Refused to load the script because it violates the following Content Security Policy directive
The page’s Content-Security-Policy doesn’t allow that script, style, image or connection source.
AbortError: The user aborted a request. / signal is aborted without reason
A fetch was cancelled through an AbortController (or the browser cancelled it).
TypeError: Failed to execute 'json' on 'Response': body stream already read
A fetch Response body was consumed twice (e.g. calling .text() then .json()).
Mixed Content: The page was loaded over HTTPS, but requested an insecure resource
An HTTPS page tried to load a script, API or image over plain HTTP, and the browser blocked (or warned about) it.
Script error. (at line 0) — cross-origin error details hidden
An error happened in a script from another origin, and the browser hid the details.
This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure
The browser refused to store or send an auth/session cookie because of SameSite or Secure rules — so logins don’t “stick” across…
Console: Refused to display 'https://…' in a frame because it set 'X-Frame-Options' to 'deny' / 'sameorigin'
The page you tried to embed in an `` forbids framing through the `X-Frame-Options` header or CSP `frame-ancestors`.
Console: SecurityError: Failed to read the 'localStorage' property from 'Window': Access is denied for this document
The page cannot use `localStorage` because cookies/site data are blocked, it runs in a sandboxed iframe, or the browser is in a r…
Console: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://a.com') does not match the recipient window's origin ('https://b.com')
`window.postMessage()` was sent with a `targetOrigin` that differs from the receiving window's real origin, so the message is dro…
Console: [Violation] Permissions policy violation: camera is not allowed in this document (Feature-Policy)
A browser feature (camera, microphone, geolocation, fullscreen, payment…) was blocked by a `Permissions-Policy` header or an ifra…
Two steps away (27)
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Error: Minified React error #31; visit https://react.dev/errors/31 for the full message
A production React build threw an error whose message was shortened to a number.
Warning: Cannot modify header information - headers already sent
You called `header()`, `setcookie()` or `session_start()` after output had already been sent to the browser.
HTTP 411 Length Required
The server refuses a request with a body but no Content-Length header.
HTTP 428 Precondition Required
The server requires a conditional request (If-Match / If-Unmodified-Since) to prevent lost updates, and you didn’t send one.
TypeError: Failed to fetch / NetworkError when attempting to fetch resource
The browser couldn’t complete the request at the network level — CORS, DNS, offline, blocked mixed content, or the server refused…
Node.js: [UnhandledPromiseRejection] — This error originated either by throwing inside of an async function without a catch block
A promise rejected and nothing handled it; since Node 15 this crashes the process.
TypeError: Reduce of empty array with no initial value
Array.reduce() ran on an empty array without an initial value.
java.net.SocketException: Connection reset
The remote side closed the TCP connection abruptly while Java was reading or writing.
SyntaxError: await is only valid in async functions and the top level bodies of modules
await was used inside a function that isn’t async (or in a classic, non-module script).
RangeError: Invalid array length
An array was created or resized with a negative, fractional or enormous length.
CLEARTEXT communication to host not permitted by network security policy
Android 9+ blocks plain `http://` requests by default; the app tried to call a non-HTTPS URL.
App Transport Security has blocked a cleartext HTTP resource load
iOS blocked an `http://` request (or a weak-TLS HTTPS one) because App Transport Security requires secure connections.
fatal: Authentication failed for 'https://github.com/x/y.git/'
HTTPS authentication to the Git host failed — wrong or expired credentials, or a password used where a token is required.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
HTTP 431 Request Header Fields Too Large
The request headers — almost always cookies — exceed the server’s size limit.
WordPress login: Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.
WordPress’s test cookie wasn’t returned on login — often a siteurl/home or domain mismatch, caching of wp-login.php, or headers a…
Chrome: You cannot visit example.com right now because the website uses HSTS (NET::ERR_CERT_… no bypass)
The site told browsers to use only valid HTTPS (HSTS), so Chrome hides the "Proceed anyway" link when its certificate has any pro…
Chrome: Aw, Snap! Something went wrong while displaying this webpage. Error code: STATUS_ACCESS_VIOLATION / SIGILL / Out of Memory
A Chrome tab crashed — out of memory, a faulty extension, a graphics/driver issue or a very heavy page.
QuotaExceededError: Failed to execute 'setItem' on 'Storage': Setting the value exceeded the quota
localStorage/sessionStorage is full (about 5 MB per origin) or storage is disabled.
Console: VersionError: The requested version (1) is less than the existing version (2) — IndexedDB open() failed
`indexedDB.open(name, version)` was called with a lower version number than the database already has.
Console: SecurityError: Failed to execute 'toDataURL' / 'getImageData' on 'HTMLCanvasElement': Tainted canvases may not be exported
You drew an image from another origin onto a canvas without CORS permission, so the browser blocks reading pixels back out.
Browser: This network requires you to sign in — captive portal (hotel, airport, café Wi-Fi) blocking HTTPS sites
The Wi-Fi needs a login or acceptance page first; until you complete it, secure sites fail with certificate or connection errors.
Console: NotAllowedError: Permission denied (getUserMedia — camera or microphone blocked)
The user (or the browser/OS/policy) denied camera or microphone access, so `navigator.mediaDevices.getUserMedia()` was rejected.
Console: User denied Geolocation / Only secure origins are allowed (geolocation) / GeolocationPositionError code 1
`navigator.geolocation` failed because the user blocked location, the page is not on HTTPS, or the OS has location services off.
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException