diegosouzapw/OmniRoute · error

INVALID_ORIGIN

INVALID_ORIGIN

Error message

Invalid request origin. Same-origin dashboard writes must include a valid dashboard CSRF token. Refresh the dashboard and retry, or set OMNIROUTE_PUBLIC_BASE_URL for non-dashboard browser integrations.

What it means

Error "Invalid request origin. Same-origin dashboard writes must include a valid dashboard CSRF token. Refresh the dashboard and retry, or set OMNIROUTE_PUBLIC_BASE_URL for non-dashboard browser integrations." thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/server/authz/pipeline.ts:217

    {
      error: {
        code: "SERVICE_UNAVAILABLE",
        message: "Server is shutting down",
        correlation_id: requestId,
      },
    },
    { status: 503 }
  );
  response.headers.set(AUTHZ_HEADER_REQUEST_ID, requestId);
  response.headers.set("Retry-After", "5");
  return response;
}

function invalidOriginResponse(requestId: string): NextResponse {
  const response = NextResponse.json(
    {
      error: {
        code: "INVALID_ORIGIN",
        message:
          "Invalid request origin. Same-origin dashboard writes must include a valid dashboard CSRF token. " +
          "Refresh the dashboard and retry, or set OMNIROUTE_PUBLIC_BASE_URL for non-dashboard browser integrations.",
        correlation_id: requestId,
      },
    },
    { status: 403 }
  );
  response.headers.set(AUTHZ_HEADER_REQUEST_ID, requestId);
  return response;
}

function isUnsafeMutationMethod(method: string): boolean {
  return !["GET", "HEAD", "OPTIONS"].includes(method.toUpperCase());
}

function stampRouteResponse(
  response: Response,

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/server/authz/pipeline.ts:217 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/1db397f810f36d7b. Report an issue: GitHub.