Next.js · Senior · Question 66 of 75

A Server Action `deletePost(id)` is used only on an admin page. Why must it still check authorization itself?

✓Correct answer: Every Server Action is a public POST endpoint that can be called directly, regardless of which page renders it
2Actions don't inherit cookies
3The admin page check runs after the action

Explanation

Validate inputs (e.g. with Zod) and verify the session and permissions inside the action or in the data-access layer it calls.

Further reading

Test yourself

Take the Next.js · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.