req.user is null in afterRead field hook after user is signed in

[Talaween]

Describe the Bug

I have the following field in a posts collection to save the user favourite posts, I have added an afterRead hook to return only the current user if the user favourite the posts otherwise it should return an empty array.

however, req.user is always returning null even for logged in users, therefore this logic fails

{
      name: 'favedBy',
      type: 'relationship',
      relationTo: 'users',
      hasMany: true,
      admin: {
        description: 'Users who have favorited this tool',
      },
      hooks: {
        afterRead: [
          async ({ value, req }) => {
            if (req.user?.roles?.includes('super-admin')) {
              return value
            }
            console.log('user:', req.user) //always print 'null' even when user is logged in

            return value?.filter((id: string) => id === req.user?.id) //this logic will not work as user is always null
          },
        ],
      },
    },

Link to the code that reproduces this issue

https://github.com/Talaween/payload/tree/main

Reproduction Steps

• run pnpm dev _community
• in broswer navigate to localhost:3000/admin
• in the terminal, the console statement prints null for the user value even though the user is logged in

Which area(s) are affected? (Select all that apply)

area: core

Environment Info

Binaries:
  Node: 23.8.0
  npm: N/A
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  payload: 3.28.1
  next: 15.2.2
  @payloadcms/db-mongodb: 3.28.1
  @payloadcms/email-nodemailer: 3.28.1
  @payloadcms/graphql: 3.28.1
  @payloadcms/next/utilities: 3.28.1
  @payloadcms/payload-cloud: 3.28.1
  @payloadcms/richtext-lexical: 3.28.1
  @payloadcms/translations: 3.28.1
  @payloadcms/ui/shared: 3.28.1
  react: 19.0.0
  react-dom: 19.0.0
Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Home
  Available memory (MB): 65274
  Available CPU cores: 32

[akhrarovsaid]

Hey @Talaween

I copied your reproduction over and can't seem to reproduce this - I'm getting the full user object logged in the afterRead hook as expected. Maybe try wiping .next/node_modules/lockfile and updating to latest?

[kristine0909]

@akhrarovsaid @Talaween

I'm experiencing the same issue, its even happening inside the access->read hook. These hooks works as intended inside the admin panel, but the user object is null in the template frontend in these hooks so access control doesnt work as intented. Using payload version 3.28.0

[r1tsuu]

These hooks works as intended inside the admin panel, but the user object is null in the template frontend in these hooks so access control doesnt work as intented. Using payload version 3.28.0

Since it's related to the frontend, do you pass user to your Local API calls? If not, user will indeed be null, even if they're signed in, the Local API won't detect automatically unless you pass user or req that contains user.

[lephattan]

These hooks works as intended inside the admin panel, but the user object is null in the template frontend in these hooks so access control doesnt work as intented. Using payload version 3.28.0

Since it's related to the frontend, do you pass user to your Local API calls? If not, user will indeed be null, even if they're signed in, the Local API won't detect automatically unless you pass user or req that contains user.

I have similar issue with read access control when payload is called in frontend, how could I get the user in the frontend?
I am using payload 3.31 with website template

[kristine0909]

These hooks works as intended inside the admin panel, but the user object is null in the template frontend in these hooks so access control doesnt work as intented. Using payload version 3.28.0

Since it's related to the frontend, do you pass user to your Local API calls? If not, user will indeed be null, even if they're signed in, the Local API won't detect automatically unless you pass user or req that contains user.

What do you mean 'pass user'? If you write something like:

access: { read: checkReadAccess, }

From my understanding everything should be passed automatically so you can use req.user from the props inside that checkReadAccess method. At least this object is the actual user when this code is run in the admin panel, but its null when its run in the frontend.

[kristine0909]

I tried using headers from next/headers to get the user object from payload.auth inside a server component for a page, however, for some pages the user object is still null, even though it works for some of them and its the same code. Why is this so unstable? How can the headers and/or user be null sometimes but not always in the request? I'm logged in on the same user for all of them - if I go to the admin panel I'm logged in.

In the page component for a collection I'm writing this

const requestHeaders = await headers()

const { user } = await payload.auth({ headers: requestHeaders })

const result = payload.find({
   collection: 'persons',
   overrideAccess: false,
   user: user,
   ...

Where headers is imported from next/headers.

I'm also using the website template.

@r1tsuu @lephattan

[lephattan]

@kristine0909 I have exactly the same problem. When you try to get user from req coming from the frontend side for access control, it just returns null.
I think it's a bug, because in the website template it implicitly means that we could just get the user object from the req. Link to the code: https://github.com/payloadcms/payload/blob/main/templates/website/src/access/authenticated.ts

import type { AccessArgs } from 'payload'

import type { User } from '@/payload-types'

type isAuthenticated = (args: AccessArgs<User>) => boolean

export const authenticated: isAuthenticated = ({ req: { user } }) => {
  return Boolean(user)
}

[Talaween]

These hooks works as intended inside the admin panel, but the user object is null in the template frontend in these hooks so access control doesnt work as intented. Using payload version 3.28.0

Since it's related to the frontend, do you pass user to your Local API calls? If not, user will indeed be null, even if they're signed in, the Local API won't detect automatically unless you pass user or req that contains user.

how Local API is used in the frontend, Local API is specific to server code not the client code, so it should automatically detect the user, also all hooks/functions/settings on the collections run on the server. am I missing something here?

I am still getting user as null when I run the code