audit-nextjs-server-actions

Secure Next.js Server Actions by adding authentication checks to prevent unauthenticated mutations. Implement input validation and CSRF protection to close attack surfaces where server endpoints are called publicly without sufficient authorization checks.

Next.js App Router server actions accept unvalidated inputs when missing validation patterns are applied before database or external calls. Identify unvalidated inputs passed to database calls and apply input validation to protect server endpoints.

The best way to add CSRF protection to Next.js Server Actions is to audit 'use server' directives for missing authentication and validate inputs. Apply security patterns to detect over-exposure of data and enforce rate limiting.

Fix missing cache invalidation patterns like revalidatePath in Next.js by detecting data over-fetching from server actions. Apply actionable remediation steps to ensure proper cache invalidation after mutations in App Router.

Yes, you can use this security audit for Next.js server actions across reads and mutations. It detects unauthenticated mutations, unvalidated inputs, and over-exposure of data in codebases using 'use server' and App Router.

Audit Next.js Server Actions for authentication gaps when applications rely on 'use server' without proper authentication. Identify missing checks, over-exposed data, and insufficient rate limiting to protect server endpoints from public calls.