payload-cms-security

Payload CMS Security

Payload (v2 / v3) gives you a powerful headless CMS in a Node app, but its security depends almost entirely on the access functions you write per collection and per field. Defaults are reasonable but not strict — production-readiness requires intentional config.

When to invoke

• Shipping a Payload app to production
• Opening the admin UI to non-developer team members or clients
• After a Payload major version upgrade (v2 → v3)
• Adding a new collection, especially user-generated or multi-tenant data
• Investigating a "user X saw user Y's data" incident

Step 1 — Lock the admin UI

By default the admin is at /admin on the same origin as the app. That is a permanent target.

Three layers of defense, use at least two:

1. Zero Trust / IP allowlist in front — put /admin behind SSO with Cloudflare Access, Tailscale, or a VPN. The admin should not be reachable from the open internet for most projects. See cloudflare-hardening.
2. Rate limit auth endpoints — /api/users/login and friends. Cloudflare Rate Limit or express-rate-limit on the Express app.
3. Strong auth for admin users — long passphrases, MFA where supported (Payload v3 has plugins for this), no shared accounts.

Optional but worth it: move /admin to an unguessable path via routes.admin. Not strong security, but cuts noise:

// payload.config.ts
export default buildConfig({
  routes: { admin: '/cms-' + process.env.ADMIN_PATH_SUFFIX },
  ...
});

Step 2 — Access control per collection

Every collection has access functions that decide who can create, read, update, delete. Defaults often allow logged-in users more than intended.

// collections/Invoices.ts
import type { CollectionConfig } from 'payload/types';

const isAdmin = ({ req: { user } }) => user?.role === 'admin';
const isOwnerOrAdmin = ({ req: { user } }) => {
  if (!user) return false;
  if (user.role === 'admin') return true;
  // Restrict to documents where ownerId equals the requesting user
  return { ownerId: { equals: user.id } };
};

export const Invoices: CollectionConfig = {
  slug: 'invoices',
  access: {
    create: ({ req: { user } }) => Boolean(user),
    read: isOwnerOrAdmin,
    update: isOwnerOrAdmin,
    delete: isAdmin,
  },
  fields: [/* ... */],
};