{"record":{"id":"34d7cce516d8d8b0","repo":"paperclipai/paperclip","slug":"board-mutation-requires-trusted-browser-origin","errorCode":null,"errorMessage":"Board mutation requires trusted browser origin","messagePattern":"Board mutation requires trusted browser origin","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/middleware/board-mutation-guard.ts","lineNumber":101,"sourceCode":"    if (req.actor.type !== \"board\") {\n      next();\n      return;\n    }\n\n    // Local-trusted mode, board bearer keys, and trusted Cloud tenant calls are\n    // not browser-session requests.\n    // In these modes, origin/referer headers can be absent; do not block those mutations.\n    if (\n      req.actor.source === \"local_implicit\"\n      || req.actor.source === \"board_key\"\n      || req.actor.source === \"cloud_tenant\"\n    ) {\n      next();\n      return;\n    }\n\n    if (!trustedBoardMutationOrigin(req)) {\n      res.status(403).json({ error: \"Board mutation requires trusted browser origin\" });\n      return;\n    }\n\n    next();\n  };\n}\n","sourceCodeStart":83,"sourceCodeEnd":108,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/middleware/board-mutation-guard.ts#L83-L108","documentation":"CSRF-style guard in boardMutationGuard: a board-session (browser) actor attempted a mutating request, but the Origin/Referer header did not match a trusted board origin. Only browser-session board mutations are checked — local_implicit, board_key, and cloud_tenant actor sources skip this check — so it fires specifically on cross-site or misconfigured-origin browser requests. Responds 403.","triggerScenarios":"Thrown at server/src/middleware/board-mutation-guard.ts:72 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Send the mutation from the trusted board UI origin; do not call it from an untrusted cross-origin context."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}