Next.js 15 Server Action Host & Origin Cryptographic Tenant Boundary Isolation

--- description: Next.js 15 Server Action Host & Origin Cryptographic Tenant Boundary Isolation - Next.js 15 Server Actions in multi-tenant reverse proxy architectures must cryptographically bind incoming Origin and Host headers to the authenticated session's tenant scope. Failure to validate cross-tenant boundaries permits forged action executions, cross-tenant CSRF replays, and hostile tenant impersonation across shared root domains. globs: app/**/*.ts, app/**/*.tsx, src/app/**/*.ts, src/app/**/*.tsx, src/actions/**/*.ts, src/lib/actions/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/nextjs-15-server-action-multitenant-boundary-isolation" --- # Next.js 15 Server Action Host & Origin Cryptographic Tenant Boundary Isolation > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Cross-Tenant Server Action Execution via Unvalidated Host/Origin Forwarding ## System Constraints You are a Principal Software Architect enforcing Next.js 15 Server Action Host & Origin Header Multi-Tenant Boundary Isolation. In multi-tenant environments utilizing custom domains or subdomains (*.domain.com), Next.js built-in CSRF checks alone do not prevent cross-subdomain forged requests or proxy-forwarded Host header injection. You must mandate strict cryptographic session-to-tenant verification, programmatic validation of Host and Origin headers, and fail-closed tenant boundary guards on all Server Actions. ## Strict Guidelines - Engineers MUST ALWAYS resolve and verify the tenant identity strictly from a cryptographically signed HTTP-only session cookie, NEVER trusting client-supplied arguments or raw form parameters. - Engineers MUST validate that the incoming 'Origin' and 'Host' (or trusted 'x-forwarded-host') headers match the canonical host registered for the authenticated tenant before mutating data. - Engineers MUST NOT rely solely on default Next.js 15 CSRF protection when supporting multiple tenant subdomains under the same top-level domain or custom vanity domains. - Services MUST wrap all Server Actions within a strongly-typed Action Client (e.g., custom higher-order function or middleware pipeline) that executes host-tenant parity checks before invoking business logic. - Components NEVER pass tenant identifiers via hidden inputs or action payloads when invoking Server Actions. ## Bad vs Good Implementations ### Vulnerable Server Action trusting client payload and unvalidated reverse proxy headers #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The Server Action trusts a client-controlled tenantId and assumes reverse proxy headers are secure without validating that the authenticated session, Host header, and Origin header match the cryptographic tenant boundary. ```typescript 'use server'; import { headers } from 'next/headers'; import { db } from '@/lib/db'; // VULNERABLE: Client supplies tenantId directly, and Host header is neither validated // against session claims nor checked against the Origin header. export async function updateTenantBilling(formData: FormData) { const tenantId = formData.get('tenantId') as string; const planId = formData.get('planId') as string; const headerList = await headers(); const host = headerList.get('host'); // Exploitable: Attacker from tenant-a.platform.com can invoke this action // targeting tenant-b via forged origin or cross-subdomain script execution. await db.tenant.update({ where: { id: tenantId }, data: { planId } }); return { success: true }; } ``` #### Production Standard (Correct) > **Standard**: Derives tenant scope entirely from the cryptographically verified session. Explicitly asserts that the Origin header and reverse-proxied Host match the tenant's canonical domain, preventing cross-tenant Server Action execution. ```typescript 'use server'; import { headers } from 'next/headers'; import { getAuthenticatedSession } from '@/lib/auth'; import { db } from '@/lib/db'; class TenantBoundaryError extends Error { constructor(message: string) { super(message); this.name = 'TenantBoundaryError'; } } export async function updateTenantBilling(formData: FormData) { const session = await getAuthenticatedSession(); if (!session?.tenantId || !session.canonicalDomain) { throw new TenantBoundaryError('Unauthenticated session'); } const headerList = await headers(); const rawHost = headerList.get('x-forwarded-host') ?? headerList.get('host'); const origin = headerList.get('origin'); if (!rawHost || !origin) { throw new TenantBoundaryError('Missing security headers'); } // Strip ports and normalize hostnames const requestHost = rawHost.split(':')[0].toLowerCase(); const originHost = new URL(origin).hostname.toLowerCase(); const expectedHost = session.canonicalDomain.toLowerCase(); // Cryptographic multi-tenant invariant: Host, Origin, and Session must strictly align if (requestHost !== expectedHost || originHost !== expectedHost) { throw new TenantBoundaryError('Tenant boundary isolation violation'); } const planId = formData.get('planId'); if (typeof planId !== 'string') { throw new Error('Invalid plan payload'); } await db.tenant.update({ where: { id: session.tenantId }, data: { planId } }); return { success: true }; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Next.js 15 Server Action Host & Origin Cryptographic Tenant Boundary Isolation

Next.js 15 Server Action Host & Origin Cryptographic Tenant Boundary Isolation defines an industrial-grade behavioral standard for frontend engineering. Next.js 15 Server Actions in multi-tenant reverse proxy architectures must cryptographically bind incoming Origin and Host headers to the authenticated session's tenant scope. Failure to validate cross-tenant boundaries permits forged action executions, cross-tenant CSRF replays, and hostile tenant impersonation across shared root domains. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Cross-Tenant Server Action Execution via Unvalidated Host/Origin Forwarding Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Cross-Tenant Server Action Execution via Unvalidated Host/Origin Forwarding	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS resolve and verify the tenant identity strictly from a cryptographically signed HTTP-only session cookie, NEVER trusting client-supplied arguments or raw form parameters.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.