Error map
cross-origin error Error: A cross-origin error was thrown. React doesn't have access to the actual error object in development.
React · layer 1, On your device
Centre: this error. First ring: errors it is linked with (7). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (7)
CORS Error: No 'Access-Control-Allow-Origin' header is present
The browser blocked a cross-origin request because the server’s response didn’t include the CORS headers allowing your site’s ori…
Error: Minified React error #31; visit https://react.dev/errors/31 for the full message
A production React build threw an error whose message was shortened to a number.
Refused to load the script because it violates the following Content Security Policy directive
The page’s Content-Security-Policy doesn’t allow that script, style, image or connection source.
Mixed Content: The page was loaded over HTTPS, but requested an insecure resource
An HTTPS page tried to load a script, API or image over plain HTTP, and the browser blocked (or warned about) it.
Script error. (at line 0) — cross-origin error details hidden
An error happened in a script from another origin, and the browser hid the details.
SecurityError: Blocked a frame with origin "x" from accessing a cross-origin frame.
Script tried to read or modify an iframe (or window) from another origin.
This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure
The browser refused to store or send an auth/session cookie because of SameSite or Secure rules — so logins don’t “stick” across…
Two steps away (21)
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Error: Objects are not valid as a React child
You tried to render a plain object (or a Promise/Date) directly in JSX; React can only render strings, numbers, elements and arra…
Error: Hydration failed because the initial UI does not match what was rendered on the server
The HTML rendered on the server differs from the first client render, so React (Next.js/Remix) can’t attach to it.
Warning: A component is changing an uncontrolled input to be controlled
An input’s `value` started as `undefined` (uncontrolled) and later became a defined value (controlled), or vice versa.
Warning: Cannot modify header information - headers already sent
You called `header()`, `setcookie()` or `session_start()` after output had already been sent to the browser.
HTTP 411 Length Required
The server refuses a request with a body but no Content-Length header.
HTTP 428 Precondition Required
The server requires a conditional request (If-Match / If-Unmodified-Since) to prevent lost updates, and you didn’t send one.
TypeError: Failed to fetch / NetworkError when attempting to fetch resource
The browser couldn’t complete the request at the network level — CORS, DNS, offline, blocked mixed content, or the server refused…
CLEARTEXT communication to host not permitted by network security policy
Android 9+ blocks plain `http://` requests by default; the app tried to call a non-HTTPS URL.
App Transport Security has blocked a cleartext HTTP resource load
iOS blocked an `http://` request (or a weak-TLS HTTPS one) because App Transport Security requires secure connections.
AbortError: The user aborted a request. / signal is aborted without reason
A fetch was cancelled through an AbortController (or the browser cancelled it).
TypeError: Failed to execute 'json' on 'Response': body stream already read
A fetch Response body was consumed twice (e.g. calling .text() then .json()).
Console: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://a.com') does not match the recipient window's origin ('https://b.com')
`window.postMessage()` was sent with a `targetOrigin` that differs from the receiving window's real origin, so the message is dro…
Console: Refused to display 'https://…' in a frame because it set 'X-Frame-Options' to 'deny' / 'sameorigin'
The page you tried to embed in an `` forbids framing through the `X-Frame-Options` header or CSP `frame-ancestors`.
Console: SecurityError: Failed to read the 'localStorage' property from 'Window': Access is denied for this document
The page cannot use `localStorage` because cookies/site data are blocked, it runs in a sandboxed iframe, or the browser is in a r…
Console: [Violation] Permissions policy violation: camera is not allowed in this document (Feature-Policy)
A browser feature (camera, microphone, geolocation, fullscreen, payment…) was blocked by a `Permissions-Policy` header or an ifra…
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
HTTP 431 Request Header Fields Too Large
The request headers — almost always cookies — exceed the server’s size limit.
WordPress login: Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.
WordPress’s test cookie wasn’t returned on login — often a siteurl/home or domain mismatch, caching of wp-login.php, or headers a…
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError