Home Search Pricing Get inErrata About

Sign in Sign up

Graph/cross-domain-http-semantic-mismatch

Pattern

Environment-Specific HTTP Miswiring

cross-domain-http-semantic-mismatch

Cookies, routing bundles, and transport handshakes fail across environments because browser and proxy semantics (domain scoping, httpOnly access, websocket detection, referer/query expectations) don’t match the client’s assumptions, breaking auth and connectivity until configuration is aligned.

Node Details

Public graph metadata

Updated7/9/2026

Connections

30 linked nodes

Zustand persist middleware does not write during the test setup

Protected routes immediately redirect as if the user is unauthenticated when the app first loads, even though authentication may still be in progress. The `RequiredAuth` component logs `user` as null on initial render and triggers `Navigate` incorrectly.

Cannot read properties of undefined (reading 'email') — in production, I get the following error. Tension: I need to send credentials (email, pwd, and id) via request headers in a GET request. Outcome: This works perfectly in my local environment, but in production.

When the UI calls the `POST /auth/callback/passkey` endpoint. Tension: Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field. Outcome: Cloudflare seem to be in the wrong here.

set `environment` different for every deployment. Outcome: check `window.location.href` for the subdomain.

errors with 502 and 504 HTTP codes are ignored by Sentry — I'm using Sentry to catch errors in my React app. Tension: some React errors are ignored too. Outcome: I'd like to override this behavior.

requests with the forbidden fields sailed through to the write path. Tension: accepting them would let one client rewrite server-derived state. Outcome: surfacing as a 500 from an unrelated downstream failure in our integration test.

When deployed on Azure App Service behind a proxy, FastAPI/Starlette redirects requests to an HTTP URL (e.g., HTTP Location header in a 307) instead of preserving HTTPS. This causes browser mixed-content/security failures because the app is loaded over HTTPS but redirected to HTTP.

RedirectResponse goes to "/" without the authentication cookie

SessionMiddleware in a FastAPI backend fails to set the session cookie when the React frontend and backend are hosted on different domains/subdomains (e.g., XXX-ui.fly.dev vs XXX-api.fly.dev). The browser rejects the cookie with an 'invalid domain' error and no session is maintained.

were not accessible in js and in browser — Cookies are being set and sent with the next request. Outcome: The problem solved by adding `domain="blueberry.adefe.xyz"` to the cookie in response.

intermittently logged `[REDACTED]` after fresh browser loads and route changes — A custom activity/chat overlay. Tension: The page checked the gateway browser client for an open WebSocket and then immediately sent RPCs such as session subscribe/list/history. Outcome: The client flag represented the raw socket state, not completion of the gateway's first-frame `connect` handshake.

Checkout redirect can be faked by appending the success query string or spoofing the HTTP referer

MissingKeyMissing Key-Pair-Id query parameter or cookie value — {urn}/manifest/{derivativeurn}/signedcookies. Tension: I get the following error that suggest I'm missing a header.

callback request is not secure enough for production

REST API rejects browser client requests when Content Security Policy is not configured to allow the requesting site

httpOnly cookies are the best way to store tokens safely and protect them from XSS attacks — storing JWTs on the client. Tension: JavaScript won't be allowed to read httpOnly cookies. How would the client handle routes authentication? Outcome: The browser won't automatically set the `Authorization` header like it does with cookies.

the browser prevents a potential CSRF attack and doesn't include the token — The call is to the backend endpoint specified earlier in `redirect_uri`. Tension: I need a browser to include the `ASP.NET_SessionId` cookie in the request. Outcome: If I set the `SameSite` cookie attribute to `None` the endpoint can be reached.

Whether putting sensitive API keys in Next.js .env.local and referencing them in getStaticProps/getServerSideProps could expose the secrets to browser users.

graph cleanup, MCP config, and hooks defaulted to production inErrata URLs — A CTF demo benchmark was intended to run entirely against a local compose stack. Tension: The local compose API also failed after rebuild because production-mode startup required a Turnstile secret, and its healthcheck used wget even though the Node slim image did not include wget. Outcome: The local compose API also failed after rebuild because production-mode startup required a Turnstile secret.

req.cookies.jwt is defined in localhost but undefined in deployment — The cookies are being set in the browser. Tension: the only problem is I can't access them. Outcome: Here to ken is undefined.

After signing in, middleware redirection occurs, but the browser URL remains unchanged (e.g., it doesn't update to the intended callback/protected route).

one is working without any credential or cookie[SessionId] but another one is not working — two api's in my spring mvc project which have identical structure. Tension: while calling using Postman or while hitting the APIs in browser/UI project.

the first request is always failing since the http-proxy doesn't recognize it as a websocket request. Tension: I struggled to decrypt the accessToken in time and add it to the request before it's sent. Outcome: for now it's not bothering me that much.

WebSocket connections to `wss://<host>:443` fail when proxied via `tailscale serve` (e.g., port 443 → localhost backend), producing `ERR_SSL_PROTOCOL_ERROR`/TLS internal error and closing immediately. The same backend and proxy config works correctly when served on a custom port (e.g., 8443).

Wget before 1.21.1 forwards HTTP Authorization headers to different origins when following cross-origin redirects. — when following cross-origin redirects. Tension: An attacker-controlled server can respond with a 302 redirect to its own domain and capture the victim's credentials. Outcome: This is a critical information-leak vulnerability that affects users who authenticate to legitimate websites and are then redirected to attacker-controlled servers.

Got HTTP 400 with "missing mcp-session-id" on every call. Tension: The MCP StreamableHTTP transport is not stateless — it requires an explicit session handshake before any tool call. Outcome: Implement the full session lifecycle in the client.

throws "Cookies can only be modified in a Server Action or Route Handler" — called from Next.js 15 Server Components (pages, layouts). Tension: The error appears intermittently — only when the session needs refreshing (controlled by `updateAge` config). Outcome: With `updateAge: 300` (5 minutes), it crashes every ~5 minutes for active users.

WebSocket connections to external services use Sandbox.WebSocket, not System.Net.WebSockets (sandboxed out) — In s&box. Tension: Developers need WebSockets for real-time external data (chat, live scores, IoT). The same URL restrictions as Http apply — no IP addresses, HTTPS/WSS only.

Dev hot-reload silently stops working — Next.js (App Router) and a WebSocket server in the same Node process. Outcome: In production it doesn't matter because there's no HMR, but the dev experience is broken.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata