{"record":{"id":"6c1f473a85c4a15f","repo":"payloadcms/payload","slug":"unauthorized-6c1f47","errorCode":null,"errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/ui/src/views/Dashboard/Default/ModularDashboard/renderWidget/renderWidgetServerFn.ts","lineNumber":32,"sourceCode":"   * The slug of the widget to render\n   */\n  widgetSlug: string\n}\n\nexport type RenderWidgetServerFnReturnType = {\n  component: React.ReactNode\n}\n\n/**\n * Server function to render a widget on-demand.\n * Similar to render-field but specifically for dashboard widgets.\n */\nexport const renderWidgetHandler: ServerFunction<\n  RenderWidgetServerFnArgs,\n  RenderWidgetServerFnReturnType\n> = ({ cookies, locale, permissions, req, widgetData, widgetSlug }) => {\n  if (!req.user) {\n    throw new Error('Unauthorized')\n  }\n\n  const { widgets } = req.payload.config.admin.dashboard\n  const { importMap } = req.payload\n\n  // Find the widget configuration\n  const widgetConfig = widgets.find((widget) => widget.slug === widgetSlug)\n\n  if (!widgetConfig) {\n    return {\n      component: React.createElement(\n        'div',\n        {\n          style: {\n            background: 'var(--color-bg-secondary)',\n            border: 'var(--stroke-width-small) solid var(--color-border)',\n            borderRadius: 'var(--radius-medium)',\n            color: 'var(--color-text)',","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/ui/src/views/Dashboard/Default/ModularDashboard/renderWidget/renderWidgetServerFn.ts#L14-L50","documentation":"The render-widget server function throws `Error('Unauthorized')` when `req.user` is absent. On-demand widget rendering is an authenticated admin operation that reads dashboard widget configs and the request's locale, so anonymous requests are rejected before any widget is located or rendered.","triggerScenarios":"Dashboard widget render fired after session timeout, programmatic widget rendering without an authenticated session, auth cookie not forwarded to the server function, custom auth strategy that does not set `req.user`.","commonSituations":"Idle sessions that lapse during dashboard use, cross-origin widget requests without credentials, auth misconfiguration, proxies stripping cookies.","solutions":["Ensure the user is logged in before widgets attempt to render on demand.","Confirm the auth cookie is forwarded with the render-widget request.","Verify the auth strategy populates `req.user` for admin routes.","Re-authenticate and retry; note a missing widget returns a friendly placeholder, but a missing user throws."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!req.user) {\n  // skip on-demand widget render or prompt re-login\n}","typeGuard":"function isAuthenticated<\n  R extends { user?: unknown },\n>(req: R): req is R & { user: NonNullable<R['user']> } {\n  return !!req.user\n}","tryCatchPattern":"try {\n  await renderWidget(args)\n} catch (err) {\n  if (err instanceof Error && err.message === 'Unauthorized') {\n    // prompt re-login; widget render can be retried once authenticated\n  } else {\n    throw err\n  }\n}","preventionTips":["Forward the auth cookie with all render-widget requests.","Re-check the session before triggering on-demand widget renders.","Confirm the auth strategy populates `req.user` for admin routes.","Distinguish this auth error from a missing-widget placeholder response."],"tags":["auth","dashboard","widgets","server-functions","unauthorized"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}