{"record":{"id":"b49fd91993ae8c4d","repo":"payloadcms/payload","slug":"unauthorized-you-must-be-logged-in-to-make-this-r-b49fd9","errorCode":null,"errorMessage":"Unauthorized, you must be logged in to make this request.","messagePattern":"Unauthorized, you must be logged in to make this request\\.","errorType":"exception","errorClass":"UnauthorizedError","httpStatus":401,"severity":"error","filePath":"packages/ui/src/utilities/slugify.ts","lineNumber":33,"sourceCode":"/**\n * This server function is directly related to the {@link https://payloadcms.com/docs/fields/slug | Slug Field}.\n * This is a server function that is used to invoke the user's custom slugify function from the client.\n * This pattern is required, as there is no other way for us to pass their function across the client-server boundary.\n *   - Not through props\n *   - Not from a server function defined within a server component (see below)\n * When a server function contains non-serializable data within its closure, it gets passed through the boundary (and breaks).\n * The only way to pass server functions to the client (that contain non-serializable data) is if it is globally defined.\n * But we also cannot define this function alongside the server component, as we will not have access to their custom slugify function.\n * See `ServerFunctionsProvider` for more details.\n */\nexport const slugifyHandler: ServerFunction<\n  SlugifyServerFunctionArgs,\n  Promise<ReturnType<Slugify>>\n> = async (args) => {\n  const { id, collectionSlug, data, globalSlug, locale, path, req, valueToSlugify } = args\n\n  if (!req.user) {\n    throw new UnauthorizedError()\n  }\n\n  const docConfig = collectionSlug\n    ? req.payload.collections[collectionSlug]?.config\n    : globalSlug\n      ? req.payload.config.globals.find((g) => g.slug === globalSlug)\n      : null\n\n  if (!docConfig) {\n    throw new Error()\n  }\n\n  const { field } = getFieldByPath({\n    config: req.payload.config,\n    fields: docConfig.flattenedFields,\n    path,\n  })\n","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/ui/src/utilities/slugify.ts#L15-L51","documentation":"The slug field's server-side slugify handler throws UnauthorizedError when `req.user` is absent. Generating a unique slug probes the collection for collisions via `getUniqueFieldValue`, which requires an authenticated admin session, so the handler rejects anonymous requests before reading field config or touching the DB. This is a deliberate auth gate, not an accidental failure.","triggerScenarios":"Slug auto-generation triggered after the admin session expired, the auth cookie not sent on the server-function fetch, a custom auth strategy that does not populate `req.user`, accessing the admin slug field while logged out.","commonSituations":"Long-idle admin tabs whose session lapsed, cross-origin server-function requests sent without credentials, auth plugin misconfiguration leaving `req.user` undefined, load-balancer/proxy stripping cookies.","solutions":["Ensure the user is logged in and the session is still valid before editing a slug field.","Verify the auth cookie is sent with the server-function request (credentials: 'include' / same-origin).","Confirm the configured auth strategy populates `req.user` for admin routes.","Re-authenticate the user and retry the slug generation."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!req.user) {\n  // surface 'login required' / redirect to /admin/login before invoking slugify\n}","typeGuard":"function isAuthenticated<\n  R extends { user?: unknown },\n>(req: R): req is R & { user: NonNullable<R['user']> } {\n  return !!req.user\n}","tryCatchPattern":"import { UnauthorizedError } from 'payload'\n\ntry {\n  await slugify(args)\n} catch (err) {\n  if (err instanceof UnauthorizedError) {\n    // session expired - prompt re-login, then retry\n  } else {\n    throw err\n  }\n}","preventionTips":["Send credentials with all admin server-function requests.","Surface session-expiry UI and re-authenticate before retrying slug generation.","Gate slug-generating inputs on a live session check in the admin client.","Confirm the auth strategy populates `req.user` for admin routes."],"tags":["auth","slug","server-functions","unauthorized"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}