Web Security · Senior · Question 66 of 75

Why does every Next.js Server Action need its own authorization check?

1Because Server Actions run in the browser
✓Correct answer: Server Actions are public HTTP endpoints; anyone can call them directly, not only through your form
3Because Next.js disables cookies in Server Actions

Explanation

Checking the user on the page that renders the form isn't enough. Verify the session and permissions inside the action, and validate arguments.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.