payloadcms/payload · error · Forbidden

You are not allowed to perform this action.

Error message

You are not allowed to perform this action.

What it means

Thrown by the Azure storage adapter's `generateUploadInstructions` as a `Forbidden(req.t)` ('You are not allowed to perform this action.') when `overrideAccess` is false and either the configured `access` function returns false OR there is no `access` function and no `req.user`. It guards the issuance of the write SAS token for staged uploads.

Source

Thrown at packages/storage-azure/src/generateUploadInstructions.ts:33

export const generateUploadInstructions = ({
  access,
  collectionPrefix,
  containerName,
  getStorageClient,
  useCompositePrefixes = false,
}: Args): GenerateUploadInstructions => {
  return async ({
    collectionSlug,
    docPrefix,
    filename,
    filesize,
    mimeType,
    overrideAccess,
    req,
  }) => {
    if (!overrideAccess && (access ? !(await access({ collectionSlug, req })) : !req.user)) {
      throw new Forbidden(req.t)
    }

    const { fileKey, sanitizedDocPrefix, sanitizedFilename } = await resolveSignedURLKey({
      collectionPrefix,
      collectionSlug,
      docPrefix,
      filename,
      req,
      useCompositePrefixes,
    })

    const blobClient = getStorageClient().getBlobClient(fileKey)

    const sasToken = generateBlobSASQueryParameters(
      {
        blobName: fileKey,
        containerName,
        contentType: mimeType,

View on GitHub (pinned to 00c58b35c0)

Solutions

1. Ensure the request carries an authenticated user that satisfies the adapter's `access` function
2. For trusted server-side calls, pass `overrideAccess: true` on the operation that triggers upload-instruction generation
3. Loosen or fix the `access` predicate if the current user genuinely should be allowed
4. If public uploads are intended, set an `access` function that returns true for the relevant collection

Example fix

// before — server call with no user
await payload.create({ collection: 'media', data, req: anonymousReq })
// after — pass an authenticated request or override
await payload.create({ collection: 'media', data, req: userReq, overrideAccess: true })

// Server-side: pass an authenticated req or overrideAccess when generating upload instructions
await payload.create({ collection: 'media', data, req: userReq, overrideAccess: true })

const res = await fetch(uploadInstructionsUrl, { credentials: 'include' })
if (res.status === 403) {
  // user lacks access or is anonymous — prompt login or use an authenticated server path
  await relogin()
}

When it happens

Trigger: An anonymous request to generate upload instructions for an Azure-backed upload collection; a logged-in user who fails the adapter's `access({ collectionSlug, req })` check; `overrideAccess` not set on a server-side call that has no user in the request context.

Common situations: Public upload form hitting the endpoint without a session; `access` function tightened to a role the current user lacks; server-to-server upload that forgot to set `overrideAccess: true` or pass a user-bearing request.

Related errors

• You are not allowed to perform this action.
• You are not allowed to perform this action.
• Unauthorized, you must be logged in to make this request.
• Unauthorized, you must be logged in to make this request.
• You are not allowed to perform this action.

AI-assisted analysis of payloadcms/payload@00c58b35c0 (2026-08-12). Data as JSON: /api/errors/ef889dc89f2cd0b3. Report an issue: GitHub.