hardFrontend

What are the security considerations for Server Actions in Next.js?

Q: What are the security considerations for Server Actions in Next.js?

**TL;DR.** Server Actions are **public HTTP endpoints**, so you must **authenticate/authorize inside each one**, **validate all inputs** (zod), and **never trust client-provided ids**. Next.js adds protections (encrypted action ids, same-origin checks), but auth and validation are **your** responsibility. authn validate authz</t

764 views

Understand the problem

Treating actions as public endpoints.

nextjsserver-actionssecurityvalidation

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

A hardened Server Action

'use server';
import { z } from 'zod';
import { auth } from '@/lib/auth';

const Schema = z.object({ postId: z.string().uuid() });

export async function deletePost(input: unknown) {
  const session = await auth();
  if (!session) throw new Error('unauthenticated');          // authn
  const { postId } = Schema.parse(input);                     // validate
  const post = await db.post.find(postId);
  if (post.authorId !== session.user.id) throw new Error('forbidden'); // authz
  await db.post.delete(postId);
}

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

How do you handle authentication in Next.js?

What is the Router Cache in Next.js and what are its implications?