RFC Registry/RFC-001
RFC-001frontendFinal
Vercel Ecosystem Verified

Next.js 15 Async Request Context & Server Actions Invariants

Formalizes asynchronous access invariants for cookies(), headers(), and dynamic route parameters in Next.js 15, prohibiting synchronous evaluation and legacy next/router usage in App Router.

Authors:Guillermo Rauch, AgentRules Working Group
Version:v1.0.0
Last Ratified:2026-02-15

RFC-2119 Invariant Mandates

The keywords “MUST”, “MUST NOT”, and “SHOULD” in this document are to be interpreted as described in BCP 14 / RFC 2119.

MUSTClause 1

All invocations of cookies() and headers() in Server Components and Route Handlers MUST be explicitly awaited as asynchronous Promises.

Engineering Rationale:Next.js 15 transitions request headers and cookies from synchronous getters to Promises to unlock partial prerendering and streaming optimizations.
Failure Blast Radius:Synchronous access throws unhandled runtime error: 'Error: Route tried to read cookies() synchronously'.
MUST NOTClause 2

App Router files MUST NOT import navigation hooks from 'next/router'. All hooks MUST originate from 'next/navigation'.

Engineering Rationale:'next/router' targets the legacy Pages Router and fails during client tree reconciliation in App Router.
Failure Blast Radius:Dual routing conflict resulting in white screen of death on client transitions.
SHOULDClause 3

Server Actions executing data mutation SHOULD validate inputs using Zod or ArkType schemas before executing database transactions.

Engineering Rationale:Unvalidated Server Actions present direct POST endpoints vulnerable to parameter tampering.
Failure Blast Radius:Arbitrary payload injection and unauthorized state modification.

Complete RFC Specification Document

IETF Formal Markdown Format
# RFC-001: Next.js 15 Async Request Context & Server Actions Invariants

## 1. Abstract
This specification defines strict architectural constraints for Next.js 15 applications utilizing the App Router architecture. It eliminates common agent hallucinations where models generate synchronous cookie access, invalid router imports, and unvalidated Server Actions.

## 2. Invariant Specifications (RFC-2119)

### 2.1 Asynchronous Request Contexts
In Next.js 15, the following APIs return Promises and MUST be awaited:
```typescript
// MUST: Await cookies and headers
const cookieStore = await cookies();
const token = cookieStore.get("session_token");

const headerStore = await headers();
const authHeader = headerStore.get("authorization");
```

### 2.2 Navigation Isolation
Under no circumstances should 'next/router' be imported inside App Router components:
```typescript
// MUST NOT
import { useRouter } from 'next/router';

// MUST
import { useRouter, usePathname, useSearchParams } from 'next/navigation';
```

## 3. Backward Compatibility
Pages router files placed under `pages/` remain exempt, but mixed directory projects must separate App Router concerns completely.

Community Consensus Rating

Do these behavioral constraints represent the highest engineering standard for your team?

99% Consensus