Server Actions lose authentication in Cloudflare Workers environment

Describe the Bug

When running Payload CMS on Cloudflare Workers (using @opennextjs/cloudflare), Server Actions in the admin UI fail to authenticate despite valid authentication cookies being sent with the request. This causes all admin form submissions (e.g., updating documents, adding relationships) to redirect to /admin/login instead of processing the request.

Server Actions receive the authentication cookie but fail to validate it, resulting in:

• POST request to /admin/collections/{collection}/{id} returns redirect to /login
• RSC (React Server Components) payload contains error digest
• Browser console shows: Error: An error occurred in the Server Components render. The specific message is omitted in production builds...

The issue only occurs in the Cloudflare Workers runtime, the same code works in standard Next.js dev mode (next dev).

When creating or editing an entry in the UI, I see all POST requests to /admin/collections/<collection-name>/<id> fail with a 500 code. The Network tab shows for each of these:
Request Headers:

• ✅ Cookie: payload-token=<valid-token> is present
• ✅ All expected headers are sent

Response:

• ❌ No Set-Cookie headers (server doesn't attempt to update cookie)
• ❌ Returns HTML with RSC error payload
• ❌ Response contains redirect digest: NEXT_REDIRECT;replace;/admin/login?redirect=%2Fadmin%2Fcollections%2F<collection-name>%2F<id>;307;

When sending the same POST request with the same payload through Postman, I get a successful response:

• When the same POST request is made via Postman (with same payload-token cookie), it returns a 200 OK with the rendered admin page HTML
• This confirms the backend authentication logic works - the issue is specific to how Server Actions handle authentication in Workers

Possible reason
The Server Action (serverFunction in src/app/(payload)/layout.tsx) calls handleServerFunctions() which should receive the authentication context. However, in the Cloudflare Workers environment:

1. The authentication cookie is sent by the browser ✅
2. The cookie reaches the server ✅
3. The Server Action execution context cannot access/validate the cookie ❌
4. Payload's auth middleware treats the request as unauthenticated
5. Server returns a redirect response
6. RSC cannot properly serialize the redirect in Workers, causing the cryptic error

This suggests that Server Actions in Cloudflare Workers don't have proper access to request headers/cookies, or the execution context is different from standard Node.js environments.

Link to the code that reproduces this issue

https://github.com/nimbleape/payload-opennextjs-cloudflare-issue-reproduction

Reproduction Steps

1. Connect the repo to a D1 database by updating the wrangler.jsonc file.
2. Run migrations with

pnpm payload migrate:create && pnpm payload deploy:database

3. Build and run the app using opennextjs-cloudflare with

pnpm preview

(this uses remote bindings).
4. In the Users collection, create a new user and try entering text in any field to see the POST requests being fired and return a 500.

Which area(s) are affected? (Select all that apply)

area: ui

Environment Info

Binaries:
  Node: 20.18.1
  npm: 10.8.2
  Yarn: 4.6.0
  pnpm: 10.22.0
Relevant Packages:
  payload: 3.64.0
  next: 15.4.7
  @opennextjs/cloudflare: 1.12.0
  @payloadcms/db-d1-sqlite: 3.64.0
  @payloadcms/drizzle: 3.64.0
  @payloadcms/graphql: 3.64.0
  @payloadcms/next/utilities: 3.64.0
  @payloadcms/plugin-cloud-storage: 3.64.0
  @payloadcms/richtext-lexical: 3.64.0
  @payloadcms/storage-r2: 3.64.0
  @payloadcms/translations: 3.64.0
  @payloadcms/ui/shared: 3.64.0
  react: 19.1.0
  react-dom: 19.1.0
  wrangler: 4.47.0
Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.5.0: Tue Apr 22 19:48:46 PDT 2025; root:xnu-11417.121.6~2/RELEASE_ARM64_T8103
  Available memory (MB): 16384
  Available CPU cores: 8