{"record":{"id":"42c022257b6e667d","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-42c022","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/payload/src/uploads/endpoints/getFileFromURL.ts","lineNumber":21,"sourceCode":"import { executeAccess } from '../../auth/executeAccess.js'\nimport { APIError } from '../../errors/APIError.js'\nimport { Forbidden } from '../../errors/Forbidden.js'\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { isURLAllowed } from '../../utilities/isURLAllowed.js'\nimport { sanitizeFilename } from '../../utilities/sanitizeFilename.js'\nimport { safeFetch } from '../safeFetch.js'\n\n// If doc id is provided, it means we are updating the doc\n// /:collectionSlug/paste-url/:doc-id?src=:fileUrl\n\n// If doc id is not provided, it means we are creating a new doc\n// /:collectionSlug/paste-url?src=:fileUrl\n\nexport const getFileFromURLHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req, { optionalID: true })\n\n  if (!req.user) {\n    throw new Forbidden(req.t)\n  }\n\n  const config = collection?.config\n\n  if (!config.upload?.pasteURL) {\n    throw new APIError('Pasting from URL is not enabled for this collection.', 400)\n  }\n\n  if (id) {\n    // updating doc\n    const accessResult = await executeAccess({ slug: config.slug, req }, config.access.update)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  } else {\n    // creating doc\n    const accessResult = await executeAccess({ slug: config.slug, req }, config.access?.create)\n    if (!accessResult) {","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/uploads/endpoints/getFileFromURL.ts#L3-L39","documentation":"Forbidden error (HTTP 403, 'You are not allowed to perform this action.') thrown at the very top of getFileFromURLHandler when req.user is falsy. The paste-URL endpoint requires an authenticated session even before collection/access checks run.","triggerScenarios":"Calling POST/GET /api/:collection/paste-url[/:doc-id]?src=<url> without a logged-in user — missing/invalid auth token, expired cookie, or no payload-auth strategy populated req.user.","commonSituations":"Frontend forgot to send the credentials/JWT; token expired; cookie not sent cross-origin (missing credentials: 'include'); custom auth strategy not setting req.user; testing the endpoint in a tool without auth headers.","solutions":["Authenticate before calling: include the Payload auth token (header Payload-Auth-Token or cookie) in the request.","On the frontend, use the Payload client's fetch with credentials: 'include' or pass the token from the auth session.","If the endpoint should be public, write a custom access function and a wrapper — but note the user check is unconditional here, so you'd need to override the endpoint.","Handle 403 by redirecting the user to login, then retrying."],"exampleFix":"// before\nfetch(`/api/media/paste-url?src=${encodeURIComponent(src)}`)\n// after — send auth token\nfetch(`/api/media/paste-url?src=${encodeURIComponent(src)}`, {\n  method: 'POST',\n  headers: { 'Content-Type': 'application/json', Authorization: `JWT ${token}` },\n})","handlingStrategy":"validation","validationCode":"function isAuthenticated(req: { user?: unknown }): boolean {\n  return Boolean(req && req.user)\n}\n// before calling paste-url:\nif (!isAuthenticated({ user: currentUser })) redirect('/login')","typeGuard":"const hasUser = (req: { user?: unknown }): req is { user: Record<string, unknown> } =>\n  Boolean(req && typeof req === 'object' && 'user' in req && req.user)","tryCatchPattern":"try {\n  await fetch(`/api/media/paste-url?src=${encodeURIComponent(src)}`, { headers: { Authorization: `JWT ${token}` } })\n} catch (e) {\n  if (e.status === 403) redirect('/login?next=' + encodeURIComponent(location.pathname))\n}","preventionTips":["Send the auth token on every API call from the client SDK.","Use credentials: 'include' for cookie-based auth cross-origin.","Refresh expired tokens before the request.","Hide paste-URL UI when no session is active."],"tags":["upload","auth","paste-url","forbidden"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}