Server Actions: Under the Hood
Unanswered
Sloth bear posted this in #help-forum
Sloth bearOP
Hello! I need to understand the security implications of server actions more thoroughly. I put together some questions to help me understand:
1) Are they essentially hidden open ports, or are they only made accessible when a page that uses the function is compiled + sent to the client?
2) When does the server know an action cannot be used by the client/webpage anymore?
3) Does the server action internally verify that the correct client/page/session is sending the request to use the action?
I hope these questions interest you too. Hopefully they aren't reposts. Cheers!
1) Are they essentially hidden open ports, or are they only made accessible when a page that uses the function is compiled + sent to the client?
2) When does the server know an action cannot be used by the client/webpage anymore?
3) Does the server action internally verify that the correct client/page/session is sending the request to use the action?
I hope these questions interest you too. Hopefully they aren't reposts. Cheers!
6 Replies
it’s http protocol, same end points as App Router, which you can figure out from Chrome Dev Tool and cURL command. it is kind rpc over http protocol. as for ACL, you need to implement it manually using Auth.js. i can show you my poc project that uses Auth.js in Server Actions if you want.
one caveat, Server Actions is still experimental feature, so the spec and impls could change
Sloth bearOP
Thanks for the manual auth example. I'm very interested in knowing whether a server action is accessible via HTTP if it's not explicitly passed to a client. Do you know where I could find implementation details?
i made sure using debugger to break inside a server action. so you can dig into the next,js implementation of rpc.
but it is still experimental feature so implementation could change.