payloadcms/payload · error

Unauthorized

Error message

Unauthorized

What it means

A plain Error('Unauthorized') thrown by the renderTab server function when req.user is falsy. This server function renders a custom sidebar tab's React component; it requires an authenticated admin session. Because it throws a bare Error (not UnauthorizedError), it surfaces without an explicit HTTP status.

Source

Thrown at packages/ui/src/elements/Nav/SidebarTabs/renderTabServerFn.ts:20

import type React from 'react'

import { RenderServerComponent } from '../../RenderServerComponent/index.js'

export type RenderTabServerFnArgs = {
  searchParams?: Record<string, unknown>
  tabSlug: string
}

export type RenderTabServerFnReturnType = {
  component: React.ReactNode
}

export const renderTabHandler: ServerFunction<
  RenderTabServerFnArgs,
  RenderTabServerFnReturnType
> = ({ req, searchParams, tabSlug }) => {
  if (!req.user) {
    throw new Error('Unauthorized')
  }

  const { importMap } = req.payload
  const { tabs } = req.payload.config.admin.components?.sidebar || {}

  if (!tabs) {
    return { component: null }
  }

  const tabConfig = tabs.find((tab) => tab.slug === tabSlug)

  if (!tabConfig) {
    return { component: null }
  }

  try {
    const component = RenderServerComponent({
      Component: tabConfig.components.Content,

View on GitHub (pinned to 00c58b35c0)

Solutions

1. Ensure the admin session cookie is present and not expired when the sidebar tab renders.
2. If the tab should be visible anonymously, gate the renderTab call on the client with a user check first.
3. Register auth middleware so req.user is populated before the server function runs.

Example fix

// before
export const renderTabHandler = ({ req, searchParams, tabSlug }) => {
  if (!req.user) throw new Error('Unauthorized')
  ...
}

// after — throw the proper UnauthorizedError so the boundary maps it to 401
import { UnauthorizedError } from 'payload'
export const renderTabHandler = ({ req, searchParams, tabSlug }) => {
  if (!req.user) throw new UnauthorizedError()
  ...
}

function canRenderTab(user: unknown): user is { id: string } {
  return Boolean(user)
}

if (!canRenderTab(req.user)) {
  // skip the renderTab call; the tab requires auth
  return { component: null }
}

function isUnauthorized(err: unknown): err is Error {
  return err instanceof Error && err.message === 'Unauthorized'
}

try {
  const { component } = await fetchServerFunction('renderTab', { tabSlug })
} catch (err) {
  if (isUnauthorized(err)) {
    redirectToLogin()
    return
  }
  throw err
}

When it happens

Trigger: The renderTab server function is invoked (sidebar tab render) while req.user is null — no session cookie, expired session, or the request reached the server function without auth context.

Common situations: Sidebar tab attempts to render on a page load after session expiry; the server function is called from a context that does not propagate the auth cookie; custom sidebar tab registered without considering anonymous access.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized, you must be logged in to make this request.
• Unauthorized, you must be logged in to make this request.
• No auth config found for collection: ${collection}
• Email or username is required.
• Unauthorized

AI-assisted analysis of payloadcms/payload@00c58b35c0 (2026-08-12). Data as JSON: /api/errors/46604e8c3d41a48a. Report an issue: GitHub.