v4: Access Control with Local API

[thernstig]

https://payloadcms.com/docs/access-control/overview states:

Important: In the Local API, all Access Control is skipped by default. This allows your server to have full control over your application. To opt back in, you can set the overrideAccess option to false in your requests.

Is this something that can be re-evaluated for V4? With React Server Components, it means any component using the payload object for the Local API then bypasses any Access Control. As RSC becomes more common, it feels dangerous having a default as skipping access control.

[thernstig]

Should I create an issue instead?

[thernstig]

Would be great if Payload maintainers could communicate with us 😆

[thernstig]

@VeiaG yes this is what I understood as well, but I argue that it should not be. It's arguably in some cases a very easy-to-miss security issue e.g. in RSC but other contexts.

"makes sense" is subjective. I prefer to go by "secure by default" route to avoid users leaking data. Which is very easy to do here.

[VeiaG]

The server is already secure - no client can touch the Local API directly. What you expose to the user is on you, same as with any db client. Like, if you use Prisma or Mongoose in RSC, you don't expect them to enforce access control either — that's just how server-side tools work. Payload's Local API is closer to a database client, rather than just alternative to rest api .

[thernstig]

I think we differ in sentiment. Payload clearly always mentions it offers "three APIs to access data". In almost all of the docs this discrepancy is not highlighthed, only in some parts. I feel this is different from Prisma, Mongoose etc. as they are inherently only "local".

I think our views differ. I think it would be more safe and recognizable if all three ways Payload can retrieve data had auth by default, or at least a global setting to change the default for the local API if wanting to disable it for all operations. That would also be an easy migration path for users.

Obviously just voicing my concern and reasoning and it looks like it'll stay like an opinion 😆

[VeiaG]

Okay, it's just my opinion.

But , i think you could make biome/eslint plugin to highlight every local api call where no overrideAccess is provided ( i think i saw somebody did that), so you always need to provide either true or false instead on relying on default

UPD: https://discordapp.com/channels/967097582721572934/967097582721572937/1479141752764891146

[thernstig]

Yes, though that would mean users in general would need to discover that plugin.

My whole reasoning around this is that Payload goes above and beyond about talking about "three APIs to access data", but one is not secure. Only mentioned in a few places. I would bet there are many projects online using this more and more in RSC (as just one example) and have no idea their app is unsecure.

I am about protecting all people. Stopping very dangerous mistakes from being made. Secure-by-default here would fix that. And honestly, missing to set overrideAccess: false is very easy to do in an RSC path.