Also known as: Next.js Server Actions, use server
Definition
Server Actions are Next.js functions marked with the 'use server' directive that run on the server and can be called from client components. Every Server Action is a public HTTP endpoint and must validate inputs with Zod, authorize identity from the session, and never trust user IDs from the request payload.
A Server Action is a function in a Next.js App Router app that runs server-side and can be invoked directly from a client component. The compiler turns the function into an HTTP endpoint behind the scenes; the import on the client side becomes a network call.
Because they are public HTTP endpoints. An attacker can construct the call manually with curl. Any validation that lives only in the React form is decoration; the action itself must validate. The canonical pattern is validate-authorize-query: safeParse the input with Zod, read identity from the session via getClaims, and only then perform the privileged operation.
A Server Action that accepts a userId parameter and uses it in the database query is an Insecure Direct Object Reference (IDOR). An attacker submits the victim's user ID and the action updates the victim's row. The fix: derive identity from the session cookie, never from the request payload.