React · Senior · Question 13 of 75
What's important to remember about 'use server' functions in terms of security?
- ✓Correct answer: They're public HTTP endpoints: check authorization and input inside
- 2They're accessible only from your app's components, so no checks are needed
- 3Next.js automatically checks user permissions before calling them
Explanation
A Server Function can be called with a direct POST request, bypassing the UI. Arguments come from the client and can be forged. Inside the function, check the session and permissions, validate data (e.g. with Zod), and don't rely on the button being visible only to admins.