paperclipai/paperclip · error

Board mutation requires trusted browser origin

Error message

Board mutation requires trusted browser origin

What it means

CSRF-style guard in boardMutationGuard: a board-session (browser) actor attempted a mutating request, but the Origin/Referer header did not match a trusted board origin. Only browser-session board mutations are checked — local_implicit, board_key, and cloud_tenant actor sources skip this check — so it fires specifically on cross-site or misconfigured-origin browser requests. Responds 403.

Solutions

1. Send the mutation from the trusted board UI origin; do not call it from an untrusted cross-origin context.

When it happens

Trigger: Thrown at server/src/middleware/board-mutation-guard.ts:72 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@3f1d897a7c (2026-09-10). Data as JSON: /api/errors/34d7cce516d8d8b0. Report an issue: GitHub.

Appendix: source

Thrown at server/src/middleware/board-mutation-guard.ts:102

      next();
      return;
    }

    // Local-trusted mode, board bearer keys, trusted Cloud tenant calls, and
    // signed Cloud control assertions are not browser-session requests.
    // In these modes, origin/referer headers can be absent; do not block those mutations.
    if (
      req.actor.source === "local_implicit"
      || req.actor.source === "board_key"
      || req.actor.source === "cloud_tenant"
      || req.actor.source === "cloud_control"
    ) {
      next();
      return;
    }

    if (!trustedBoardMutationOrigin(req)) {
      res.status(403).json({ error: "Board mutation requires trusted browser origin" });
      return;
    }

    next();
  };
}

View on GitHub (pinned to 3f1d897a7c)