100% Clientseitige Berechnung • Keine Server-Logs • Sofortige Ausführung
Curious TechieEntwickler-Toolbox
Troubleshooting & Root Cause Remediation13 Verified Diagnostic Guides • Instant Code Fixes • DE

Troubleshooting & Fehlerbehebung

Direkte Diagnoseanleitungen, architektonische Ursachenanalysen und verifizierte Lösungen für die Praxis.

Showing 13 of 13 solutions
CORS & CSP Security6 min

CORS-Fehler beheben: Fehlender Access-Control-Allow-Origin Header

Access to fetch at "https://api.example.com/data" from origin "https://app.example.com" has been blocked by CORS policy: No "Access-Control-Allow-Origin" header is present on the requested resource.

Der Fehler tritt auf, weil der Server den Access-Control-Allow-Origin-Header in der HTTP-Antwort nicht mitsendet. Konfigurieren Sie diesen Header serverseitig.

HTTP/1.1HTTP/2Fetch API
✓ Verified SolutionSchritte anzeigen→
CORS & CSP Security7 min

How to Fix CORS Preflight Errors

Response to preflight request doesn't pass access control check: It does not have HTTP ok status. / Method Not Allowed (405).

A CORS preflight error occurs when your backend fails to return a successful HTTP status (200 OK or 204 No Content) on the automatic preflight HTTP OPTIONS request, or fails to include Access-Control-Allow-Methods and Access-Control-Allow-Headers.

HTTP OPTIONSFetch APIAxios
✓ Verified SolutionSchritte anzeigen→
CORS & CSP Security7 min

Why CSP Blocks JavaScript

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.

The browser blocked your JavaScript because your server’s Content-Security-Policy (CSP) header does not permit inline scripts or the external domain hosting the script in its script-src directive.

Content-Security-PolicyDOM Script ExecutionWeb Workers
✓ Verified SolutionSchritte anzeigen→
Authentication & JWT6 min

Why JWT Works in Postman but Not in Browser

Access to fetch at "https://api.example.com/me" from origin "https://app.example.com" has been blocked by CORS policy. OR: 401 Unauthorized (Missing token).

The request succeeds in Postman because Postman does not enforce the browser Same-Origin Policy (SOP). In a web browser, adding an Authorization: Bearer header triggers an automatic CORS preflight (HTTP OPTIONS) probe. If the backend fails the preflight or omits authorization from Access-Control-Allow-Headers, the browser blocks the token before the server ever reads it.

Fetch APIAxiosCORS
✓ Verified SolutionSchritte anzeigen→
Authentication & JWT7 min

Why JWT Signature Validation Fails

JsonWebTokenError: invalid signature / io.jsonwebtoken.security.SignatureException: JWT signature does not match locally computed signature.

A JWT signature verification failure means the cryptographic hash of the Header + Payload calculated by the receiver does not match the Signature segment attached to the token, almost always caused by a secret key mismatch, algorithm mismatch (HS256 vs RS256), or key formatting errors.

RFC 7519 (JWT)RFC 7515 (JWS)RS256 / HS256
✓ Verified SolutionSchritte anzeigen→
Networking, DNS & HTTPS7 min

Why DNS Works on One Device but Not Another

DNS_PROBE_FINISHED_NXDOMAIN or ERR_NAME_NOT_RESOLVED (Device A: Resolves to 198.51.100.1; Device B: Resolves to 203.0.113.5).

Devices resolve domains differently because they query different recursive resolvers (e.g., local ISP router DNS vs. public 1.1.1.1 or browser-native DoH), adhere to cached records governed by the previous TTL, or have local /etc/hosts overrides.

DNS (UDP 53)DoH (DNS-over-HTTPS)mDNS
✓ Verified SolutionSchritte anzeigen→
Networking, DNS & HTTPS6 min

Why DNS Returns NXDOMAIN

DNS_PROBE_FINISHED_NXDOMAIN (RCODE 3: Non-Existent Domain).

NXDOMAIN (Non-Existent Domain) means the authoritative nameserver confirmed that no record exists for that domain or subdomain. Common causes include missing A/CNAME records, domain expiration at the registrar, broken NS delegation, or DNSSEC validation failures where the parent DS record points to outdated keys.

DNS (RFC 1035)DNSSEC (RFC 4034)UDP/TCP 53
✓ Verified SolutionSchritte anzeigen→
Networking, DNS & HTTPS7 min

Why HTTPS Shows Mixed Content

Mixed Content: The page at "https://example.com" was loaded over HTTPS, but requested an insecure resource "http://cdn.example.com/lib.js". This request has been blocked.

Mixed content happens when an initial HTML document is loaded securely over HTTPS, but subresources (scripts, images, stylesheets, iframes, fonts, or AJAX endpoints) are requested using unencrypted HTTP:// URLs.

HTTPS (TLS 1.2 / 1.3)HTTP/1.1Content Security Policy (CSP)
✓ Verified SolutionSchritte anzeigen→
Networking, DNS & HTTPS8 min

Why HTTPS Certificate Errors Occur

NET::ERR_CERT_COMMON_NAME_INVALID or NET::ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER.

HTTPS certificate errors occur when the browser cannot establish a cryptographically valid trust path from the server’s certificate to a pre-installed root Certificate Authority (CA), when the certificate has expired, or when the domain name does not match the Subject Alternative Names (SAN) on the certificate.

TLS 1.3TLS 1.2X.509 Certificates (RFC 5280)
✓ Verified SolutionSchritte anzeigen→
HTTP Status Codes7 min

Website liefert HTTP 403 Forbidden: Ursachen und Behebung

403 Forbidden (Nginx: "403 Forbidden", Apache: "You don’t have permission to access this resource", Cloudflare: "Error 1020: Access Denied").

HTTP 403 Forbidden bedeutet, dass der Server die Anfrage verstanden hat, den Zugriff aufgrund fehlender Rechte oder Sicherheitsregeln jedoch verweigert.

HTTP/1.1HTTP/2REST APIs
✓ Verified SolutionSchritte anzeigen→
HTTP Status Codes7 min

Why a Website Returns 401

401 Unauthorized (Response includes: WWW-Authenticate: Bearer error="invalid_token", error_description="The access token expired").

An HTTP 401 Unauthorized response means the target resource requires user authentication and the request either omitted credentials or provided credentials that are expired, revoked, or malformed. By RFC specification, a 401 response must include a WWW-Authenticate header explaining how the client can authenticate.

HTTP/1.1HTTP/2OAuth 2.0
✓ Verified SolutionSchritte anzeigen→
HTTP Status Codes6 min

Why a Website Returns 404

404 Not Found (Nginx: "404 Not Found", Apache: "The requested URL was not found on this server", Cloudflare: "Error 404").

An HTTP 404 Not Found status means the server found no file or route matching the requested URI path. In Single Page Applications (SPAs), 404s happen on page refresh because the web server looks for a physical file (e.g., /dashboard/index.html) that does not exist. On Linux web hosts, 404s also frequently stem from case-sensitive filenames (e.g. Logo.PNG vs logo.png).

HTTP/1.1HTTP/2HTML5 History API
✓ Verified SolutionSchritte anzeigen→
Regex & Performance8 min

Why Regex Causes Catastrophic Backtracking

RangeError: Maximum call stack size exceeded OR Thread Hang / Unresponsive Event Loop (Execution time exceeds 30,000ms).

Catastrophic backtracking occurs when a traditional NFA (Nondeterministic Finite Automaton) regex engine encounters an "evil regex" pattern—typically containing nested quantifiers like `(a+)+` or overlapping alternations like `(a|a)+`—evaluating an input string that fails near the end. The engine exhaustively tries every exponential combinatorial permutation (O(2^n) steps) before finally declaring that the string does not match.

JavaScript V8 RegExpPython reJava java.util.regex
✓ Verified SolutionSchritte anzeigen→