Error map
cross-origin error Error: A cross-origin error was thrown. React doesn't have access to the actual error object in development.
React · layer 1, On your device
Centre: this error. First ring: errors it is linked with (7). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (7)
CORS Error: No 'Access-Control-Allow-Origin' header is present
The browser blocked a cross-origin request because the server’s response didn’t include the CORS headers allowing your site’s ori…
Error: Minified React error #31; visit https://react.dev/errors/31 for the full message
A production React build threw an error whose message was shortened to a number.
Mixed Content: The page was loaded over HTTPS, but requested an insecure resource
An HTTPS page tried to load a script, API or image over plain HTTP, and the browser blocked (or warned about) it.
Refused to load the script because it violates the following Content Security Policy directive
The page’s Content-Security-Policy doesn’t allow that script, style, image or connection source.
SecurityError: Blocked a frame with origin "x" from accessing a cross-origin frame.
Script tried to read or modify an iframe (or window) from another origin.
Script error. (at line 0) — cross-origin error details hidden
An error happened in a script from another origin, and the browser hid the details.
This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure
The browser refused to store or send an auth/session cookie because of SameSite or Secure rules — so logins don’t “stick” across…
Two steps away (19)
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Error: Objects are not valid as a React child
You tried to render a plain object (or a Promise/Date) directly in JSX; React can only render strings, numbers, elements and arra…
Error: Hydration failed because the initial UI does not match what was rendered on the server
The HTML rendered on the server differs from the first client render, so React (Next.js/Remix) can’t attach to it.
Warning: A component is changing an uncontrolled input to be controlled
An input’s `value` started as `undefined` (uncontrolled) and later became a defined value (controlled), or vice versa.
TypeError: Failed to fetch / NetworkError when attempting to fetch resource
The browser couldn’t complete the request at the network level — CORS, DNS, offline, blocked mixed content, or the server refused…
CLEARTEXT communication to host not permitted by network security policy
Android 9+ blocks plain `http://` requests by default; the app tried to call a non-HTTPS URL.
App Transport Security has blocked a cleartext HTTP resource load
iOS blocked an `http://` request (or a weak-TLS HTTPS one) because App Transport Security requires secure connections.
Warning: Cannot modify header information - headers already sent
You called `header()`, `setcookie()` or `session_start()` after output had already been sent to the browser.
HTTP 411 Length Required
The server refuses a request with a body but no Content-Length header.
HTTP 428 Precondition Required
The server requires a conditional request (If-Match / If-Unmodified-Since) to prevent lost updates, and you didn’t send one.
AbortError: The user aborted a request. / signal is aborted without reason
A fetch was cancelled through an AbortController (or the browser cancelled it).
TypeError: Failed to execute 'json' on 'Response': body stream already read
A fetch Response body was consumed twice (e.g. calling .text() then .json()).
Console: Refused to display 'https://…' in a frame because it set 'X-Frame-Options' to 'deny' / 'sameorigin'
The page you tried to embed in an `` forbids framing through the `X-Frame-Options` header or CSP `frame-ancestors`.
Console: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://a.com') does not match the recipient window's origin ('https://b.com')
`window.postMessage()` was sent with a `targetOrigin` that differs from the receiving window's real origin, so the message is dro…
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
HTTP 431 Request Header Fields Too Large
The request headers — almost always cookies — exceed the server’s size limit.
WordPress login: Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.
WordPress’s test cookie wasn’t returned on login — often a siteurl/home or domain mismatch, caching of wp-login.php, or headers a…
Map another error
Popular: 403500400TypeErrorCritical error0xC000007BNullPointerException404