Next.js · Senior · Question 7 of 75
How does Next.js protect Server Actions from CSRF?
- ✓Correct answer: It accepts only POST and compares the Origin header with Host
- 2It requires a CSRF token in every form, which you must generate manually
- 3It doesn't: CSRF protection is entirely up to the developer
Explanation
Server Actions can be invoked only with POST, and Next.js compares Origin with Host (or X-Forwarded-Host), rejecting requests from other sites. Together with SameSite cookies, this blocks most CSRF attacks. For complex proxy setups there's serverActions.allowedOrigins. Authorization is still checked inside the action.