iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Do Server Actions need CSRF protection? Next.js provides Server Actions with a built-in origin check: it compares the request’s Origin with Host or X-Forwarded-Host and rejects mismatches. That safeguard does not automatically extend to custom Route Handlers or Pages API routes. If one of those endpoints changes state using browser-sent cookies, assess and protect it against CSRF separately. And origin checking is not a substitute for authentication, authorization, or input validation.
What CSRF protection Next.js provides for Server Actions
Cross-site request forgery (CSRF) exploits a browser’s tendency to attach ambient credentials—often session cookies—to a request initiated from another site. The attacker tries to make an authenticated user’s browser perform an action the user did not intend.
Next.js Server Actions are invoked using POST. Next.js adds an origin check: it compares the request’s Origin header with the request’s Host header, or X-Forwarded-Host when that is used. A mismatch is rejected. Next.js describes this as an additional CSRF protection, not a guarantee that every CSRF risk in an application has disappeared. See the Next.js Server Actions configuration documentation.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →When the externally visible host differs from the backend host because of a reverse proxy, configure only the additional Server Action origins the application actually needs. The proxy’s forwarded host information must be trustworthy; otherwise, an attacker-controlled value could undermine the assumptions behind the check. Next.js documents the relevant configuration and its behavior in its Server Actions configuration reference.
#1 Best Overall
Why that check does not secure your custom API routes
A Server Action and a custom HTTP endpoint are different entry points. A Route Handler or legacy Pages API route does not inherit the Server Action origin check merely because it is part of the same Next.js application. Each handler needs its own assessment based on what it does and how it authenticates requests.
The classic CSRF concern is strongest when a browser automatically sends the credential—such as a session cookie—with a cross-site request. For each state-changing custom route, ask whether it accepts ambient browser credentials, whether it can be reached cross-origin, and what defenses it enforces. An endpoint authenticated only by a bearer token explicitly supplied in an Authorization header has a different classic cookie-based CSRF threat model. That distinction does not remove the need to enforce authorization, validate input, or define an appropriate cross-origin policy.
Rank #2
- Comes with secure packaging
- It can be a gift item
- Easy to read text
| Entry point | Framework-provided origin check | What the application must enforce |
|---|---|---|
| Server Action | Next.js compares Origin with Host or X-Forwarded-Host and rejects mismatches. |
Authenticate and authorize the operation, validate client input, and configure trusted proxy origins where needed. |
| Custom Route Handler or Pages API route | The Server Action check does not automatically apply. | Assess credentials and state changes per route; add an appropriate CSRF defense when browser-sent credentials are in use, plus authentication, authorization, and input validation. |
Choose a CSRF defense for cookie-authenticated routes
For a stateful application with a server-side session, OWASP recommends the synchronizer token pattern: the server issues a token associated with the session, and the application requires and validates that token on a state-changing request. For a stateless design, OWASP recommends a properly signed, session-bound double-submit token rather than a naive check that merely compares a cookie value with a request value. The token must be validated in an appropriate request location, such as a header or form field; accepting a value just because it appears in a cookie does not establish that the request is legitimate. See the OWASP CSRF Prevention Cheat Sheet.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Stateful session: Use a synchronizer token tied to the server-side session and check it on every relevant state-changing operation.
- Stateless session: If using double-submit, sign the token and bind it to session-specific data. OWASP warns that naive double-submit designs can be vulnerable to cookie injection.
- API-driven client: A required custom header can be part of the defense when the server enforces it and the endpoint’s credential flow supports that approach.
Origin validation and Fetch Metadata checks can add useful signals. Set the session cookie’s SameSite policy deliberately as another defensive layer, not as a replacement for a CSRF policy; cookie scope and application behavior can affect what it protects. CORS alone is not a CSRF defense: it primarily governs whether browser scripts can read cross-origin responses, not whether a browser can send every kind of request.
Rank #3
Keep state changes out of safe HTTP methods
Do not mutate application state in GET, HEAD, or OPTIONS handlers. These methods are expected to be safe, and browsers, crawlers, prefetchers, or other intermediaries may issue them in ways that make hidden state changes surprising and difficult to defend. Put mutations behind an explicitly state-changing method and apply the route’s authentication, authorization, validation, and CSRF checks there.
Secure every action and handler at its own boundary
Next.js advises developers to treat Server Actions as public-facing endpoints. A user interface restriction—such as hiding a button—or a page-level access check does not protect the endpoint itself. Put the checks inside the action or handler that performs the operation. See the Next.js Data Security guide.
- Inventory state-changing entry points. Include Server Actions, App Router Route Handlers, and any Pages API routes that remain in use.
- Authenticate and authorize in each operation. Confirm the caller’s identity and permission where the mutation occurs; do not rely on navigation or UI visibility.
- Validate all client-controlled data. Check submitted fields, route parameters, headers, and any other values the client can supply.
- Classify credentials per custom route. Determine whether the browser attaches cookies automatically or whether a credential is explicitly supplied, such as through an authorization header.
- Apply a route-appropriate CSRF defense. For cookie-authenticated mutations, select and enforce a token or custom-header strategy, and use Origin or Fetch Metadata checks where suitable.
- Review methods, cookies, and deployment headers. Keep safe methods free of mutations, choose a deliberate
SameSitecookie setting, and verify trusted proxy behavior for Server Action origin checks. - Test the deployed arrangement. Exercise cross-origin requests against the actual public host and proxy setup, not only a local development server.
The documentation establishes the framework’s stated safeguards and recommendations; it does not provide a measured effectiveness figure or a test result for a particular application. A deployment still needs route-by-route review and testing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
