페이로드 로컬 API: HTTP는 0이지만 원할 때 전체 액세스 제어

payload.find() hits the database directly, in the same process — no HTTP, no fetch. By default it also bypasses access control, on the assumption that server-side code trusts itself.

That assumption is exactly where holes appear. In server functions and endpoints that run on behalf of a user, you have to consciously turn enforcement on:

// DANGEROUS — full access, ignores access control
const docs = await payload.find({ collection: 'posts' })

// SAFE — respects access control for the given user
const docs = await payload.find({
  collection: 'posts',
  overrideAccess: false,
  user,
})

Enter fullscreen mode Exit fullscreen mode

The trap is the default: overrideAccess is true unless you say otherwise. Any Local API call that returns data to an end user should pass overrideAccess: false and the user.