ERROR (payload): Forbidden: You are not allowed to perform this action.

[eduhdev12]

Bug Report

Hi, I deployed my payload-cms to docker on a vps, but after the first user registration I don't have access to anything. Everything works fine, no other errors in the container logs, but I can't create any new data in the collection due to "ERROR (payload): Forbidden: You are not allowed to perform this action".
This only happens in a production environment, but running yarn serve on a local machine doesn't present any problems.

Steps to Reproduce

1. Account registration process
2. Creation of a new category attempt

Other Details

Payload version: 1.5.9

[jmikrut]

Hey @eduhdev12 — this is probably related to one of two things:

1. your cookie config. You should open your inspector, look at the Network tab, and inspect the auth cookie that is being set. Make sure it doesn't get blocked for any reason. It could be that you have some cookie settings that are conflicting with your live instance.
2. CSRF. Take a look at this link: https://payloadcms.com/docs/authentication/overview#csrf-protection - you may need to whitelist your production domain within your csrf settings to allow the cookie to be read while on your production domain.

I'll convert this to a discussion to keep conversation going as this is not a problem with Payload itself, but I'm more than happy to help!

[thenaazimkhan]

I am also facing the same issue. for me, all the access (create, update, delete) is working fine on my local dev but when I push my app to production the access (create, update, delete) control is through the "Forbidden: You are not allowed to perform this action." read is working fine on prod.

#2722

[Barbacoa08]

@thenaazimkhan, my issue was resolved by adding http+https to my cors and csrf rules in my payload config (example image attached), as described in the selected answer for this discussion.

[thenaazimkhan]

@Barbacoa08, thanks for your reply.
in your config, you are using User collection for the admin login. but in my case, I have two collections, one is Admin only for the admin user and one is User for the frontend user login.

My issue is resolved after removing the serverURL from payload.config.ts, access control is working fine except for Admin collection means all the access is applying to the other collection but when I am applying access control on my Admin collection, the access is not working.
note: all working fine in dev env only issue is on prod.

payload.config.ts

collection/index.ts

Admins.ts

this is for login into the admin panel. you can see I have put console.log in access.read fn. I can see the log in dev env but when i pushed the same to my production I can not see any log means.

Users.ts

frontend user login

[Barbacoa08]

Oof, sorry I can't help with that. Your setup is much more complicated than mine and I haven't had to any of that, sorry I can't help more 😞

[thenaazimkhan]

np thanks, man...

[Barbacoa08]

This sounds like the same issue that I'm running into (link to my discussion).

Related, the deployment docs is 404.

[Barbacoa08]

https

[eduhdev12]

I made a little progress, now () => true works good, but any access guard or checking if user is undefined is not working at all, doing requests from the cms and I get the user as undefined all the time

[Barbacoa08]

Are you using a docker container? It sounds like you're in basically the same situation that I am now, and I'm wondering how close our projects are.

My hosting environment is running a docker container. And I'm wondering if it's the docker container that's causing these auth issues.

Also, do you have any csrf and/or cors settings in your payload.config.ts?

[eduhdev12]

Yes, I am using a normal docker container and csrf, cors: "*", sometimes it makes a double call to create access and the first one is undefined and the second one contains the user, but the error comes up without any action.

[Barbacoa08]

Yup, that's what I'm seeing as well. I have my csrf and cors locked to my environment, but otherwise we seem to have the same setup and are seeing the same thing happen.

[eduhdev12]

Hello, in my case someone helped me and changed the csrf that must follow the prefix connection type if it's http or https and now seems to work flawlessly!