Q33: How does Next.js protect Server Actions against Cross-Site Request Forgery (CSRF)?
Next.js Server Actions use strict built-in CSRF defenses. They verify the incoming Origin header against the application's target host header during HTTP POST requests. Requests from mismatching origins are rejected automatically.
Key Takeaways
- Verifies
OriginvsHostheaders automatically on Server Action POST requests. - Can configure trusted origins inside
next.config.js(experimental.serverActions.allowedOrigins).
Knowledge Check
How does Next.js validate Server Action requests to prevent cross-site CSRF attacks?