for data fetching, you should just use server components instead

No need for a server action 🙂

what if its from a client component? i was able to use server actions for paginated queries. is there a reason i'd favor api route vs this since its just an RPC?

from client components then api routes and server functions are the same yes, server functions are just POST requests behind the scenes

i'm yet to see a case where server functions are worse than route handlers, if you don't need to expose an easy-to-use interface for other applications consuming your nextjs backend

yeah thats where im fuzzy on best practices. it seems api routes are kinda phased out for these RPC's

(in app dir)

yeah, i agree. as for best practices, it's too early to call, server actions have been around for only a few months. But I do think that if you don't need an external application consuming your API (so the API spec can be complex/hidden), then you don't need route handlers at all

ok i dont feel as crazy anymore

only issue with server functions to me is that server side validation is apparently not necessary

since you can type the signature of server functions

but it is still necessary and you still need to validate all parameters passed to your server functions

you can still validate before invoking the function if you really need to validate inputs id think?

but yeah seems unnecessary since we can just type like you said. yeah idk shrug on this one

you need to validate it server-side like this

no it is necessary

an attacker can simply inspect the network tab

and figure out the relevant information

ah right

and send invalid server functions parameters to your function

I tried to attack myself in that way and succeeded

you need server-side validations in all cases

yeah on mutations in general you'd always need to validate

awesome, well i feel much more less crazy about not using api routes

even for queries. if your function is getData(page, perPage) then you need to ensure both page and perPage values are actually numbers for example

else an attacker can simply send getData("hello", "world") and your app could go up in flames

what would be the attack here? them borking the app for themselves or do you mean my app cant handle invalid args and somehow my backend goes to flames

yes, your server needs to be able to handle invalid args

just like in route handlers, we need to validate everything and handle invalid input well

we can agree to disagree on the query front :p

happy coding!

haha. oh wait is there caching differences between api routes vs a server action. i think the caching story for api routes actually exists vs the latter

yes, that's why server actions are mainly used for mutations

but i don't need to use the static/caching feature of route handlers anywhere

fair enough!

appreciate your insight ❤️