Next.js › Server Actions & Mutations

What security considerations are unique to server actions compared to regular server side code, since they can be called directly from the browser?

Advanced

Answer

Since server actions are exposed as callable endpoints, you must treat every input they receive as untrusted, just as you would with a public API, always validating the data's shape, checking that the current user is authorized to perform the action, and never assuming the client sent exactly what your form intended.

'use server';

export async function updateProfile(formData) {
  const session = await getSession();
  if (!session) throw new Error('Unauthorized');
  // Always validate input even though it came from your own form
  const name = String(formData.get('name')).slice(0, 100);
  await db.user.update({ where: { id: session.user.id }, data: { name } });
}

Real-world example A profile update feature checks that the request comes from an authenticated user and limits the length of the submitted name, protecting against both unauthorized access and unexpectedly large or malicious input.

Common follow-ups: How is securing a server action similar to securing a public API route?;What tools can help audit server actions for missing authorization checks?

Security Best Practices in Next.js;Authentication & Authorization in Next.js