payloadcms/payload · error · Error

Unauthorized

Error message

Unauthorized

What it means

The dashboard's get-default-layout server function throws a plain `Error('Unauthorized')` when `req.user` is missing. Resetting the dashboard to its default layout reads from `config.admin.dashboard` and renders widgets server-side, which is an authenticated admin action, so anonymous requests are rejected up front.

Source

Thrown at packages/ui/src/views/Dashboard/Default/ModularDashboard/renderWidget/getDefaultLayoutServerFn.ts:28

import { RenderServerComponent } from '../../../../../elements/RenderServerComponent/index.js'

export type GetDefaultLayoutServerFnArgs = Record<string, never>

export type GetDefaultLayoutServerFnReturnType = {
  layout: WidgetInstanceClient[]
}

/**
 * Server function to get the default dashboard layout on-demand.
 * Used when resetting the dashboard to its default configuration.
 */
export const getDefaultLayoutHandler: ServerFunction<
  GetDefaultLayoutServerFnArgs,
  Promise<GetDefaultLayoutServerFnReturnType>
> = async ({ cookies, locale, permissions, req }) => {
  if (!req.user) {
    throw new Error('Unauthorized')
  }

  const { defaultLayout = [], widgets = [] } = req.payload.config.admin.dashboard || {}
  const { importMap } = req.payload

  const layoutItems = await getItemsFromConfig(defaultLayout, req, widgets)

  const layout: WidgetInstanceClient[] = layoutItems.map((layoutItem) => {
    const widgetSlug = layoutItem.id.slice(0, layoutItem.id.lastIndexOf('-'))
    return {
      component: RenderServerComponent({
        Component: widgets.find((widget) => widget.slug === widgetSlug)?.Component,
        importMap,
        serverProps: {
          cookies,
          locale,
          permissions,
          req,

View on GitHub (pinned to 00c58b35c0)

Solutions

1. Ensure the user is logged in before the reset action is available.
2. Confirm the auth cookie is sent with the dashboard server-function requests.
3. Verify the auth strategy populates `req.user` for admin routes.
4. Re-authenticate and retry the reset.

if (!req.user) {
  // gate the 'reset to default layout' action behind a live session check
}

function isAuthenticated<
  R extends { user?: unknown },
>(req: R): req is R & { user: NonNullable<R['user']> } {
  return !!req.user
}

try {
  await getDefaultLayout(args)
} catch (err) {
  if (err instanceof Error && err.message === 'Unauthorized') {
    // prompt re-login, then retry the reset
  } else {
    throw err
  }
}

When it happens

Trigger: Clicking 'reset to default layout' after the session expired, loading the dashboard while logged out, the auth cookie not forwarded to the server function, an auth strategy that leaves `req.user` unset.

Common situations: Idle admin sessions that lapse, cross-origin dashboard requests without credentials, auth plugin misconfiguration, proxy stripping session cookies.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized
• Unauthorized, you must be logged in to make this request.
• Unauthorized
• Unauthorized
• Unauthorized, you must be logged in to make this request.

AI-assisted analysis of payloadcms/payload@00c58b35c0 (2026-08-12). Data as JSON: /api/errors/98242106048c95e1. Report an issue: GitHub.