Next.js 15 Server Actions Session Authorization & CSRF Mitigation Standard

--- description: Next.js 15 Server Actions Session Authorization & CSRF Mitigation Standard - Enterprise security standard for Next.js 15 Server Actions. Mandates strict session authentication checks inside action bodies, Zod payload schema validation, CSRF origin verification, and prevents exposed POST mutations without authorization. (OWASP A01:2021 Broken Access Control / CWE-352). globs: **/actions/**/*.ts, **/actions.ts, **/app/**/*.tsx alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/nextjs-server-actions-csrf-authorization" --- # Next.js 15 Server Actions Session Authorization & CSRF Mitigation Standard > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: AI treats Next.js Server Actions like private internal functions, omitting session authentication and permitting unauthenticated public POST mutations. ## System Constraints You are a Next.js Security Architect. Every Next.js Server Action declared with 'use server' is a publicly accessible HTTP POST endpoint. NEVER trust client inputs or assume the caller is authenticated. You MUST authenticate the caller session and parse inputs with strict Zod schemas inside every Server Action. ## Strict Guidelines - MUST check server session authentication (e.g. auth() / getServerSession()) as the very first line inside every Server Action. - MUST sanitize and validate all action parameters using Zod safeParse(); never cast directly with 'as Type'. - MUST NOT execute administrative mutations (role upgrade, project deletion, payment charge) without explicit RBAC/tenant verification. - SHOULD return typed structured error envelopes ({ success: false, error: '...' }) rather than throwing unhandled exceptions across server boundaries. - MUST enforce rate limiting on sensitive Server Actions (e.g. password reset, invite send) via Redis token bucket. ## Bad vs Good Implementations ### Hardened Server Action with Session Guard and Zod Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Next.js Server Actions compile to public HTTP POST endpoints. Omitting authentication checks allows any malicious user or bot to invoke the action directly with arbitrary IDs, destroying customer data. ```typescript // FATAL: Publicly exposed mutation endpoint with zero auth or schema validation 'use server'; import { db } from '@/lib/db'; export async function deleteProjectAction(formData: FormData) { const projectId = formData.get('projectId') as string; // CRITICAL VULNERABILITY: Any unauthenticated user on the internet can POST to this action! await db.project.delete({ where: { id: projectId } }); } ``` #### Production Standard (Correct) > **Standard**: Guarantees session verification, validates parameters against UUID format via Zod, and checks tenant ownership before performing destructive database mutations. ```typescript 'use server'; import { auth } from '@/auth'; import { z } from 'zod'; import { db } from '@/lib/db'; const DeleteProjectSchema = z.object({ projectId: z.string().uuid(), }); export async function deleteProjectAction(input: unknown) { // 1. Mandatory Session Authentication Guard const session = await auth(); if (!session?.user?.id) { return { success: false, error: 'Unauthorized: Authentication required' }; } // 2. Strict Input Schema Validation const parsed = DeleteProjectSchema.safeParse(input); if (!parsed.success) { return { success: false, error: 'Invalid input parameters' }; } // 3. Tenant Boundary & Ownership Authorization const project = await db.project.findFirst({ where: { id: parsed.data.projectId, ownerId: session.user.id }, }); if (!project) { return { success: false, error: 'Forbidden: You do not own this project' }; } await db.project.delete({ where: { id: parsed.data.projectId } }); return { success: true }; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Next.js 15 Server Actions Session Authorization & CSRF Mitigation Standard

Next.js 15 Server Actions Session Authorization & CSRF Mitigation Standard defines an industrial-grade behavioral standard for frontend engineering. Enterprise security standard for Next.js 15 Server Actions. Mandates strict session authentication checks inside action bodies, Zod payload schema validation, CSRF origin verification, and prevents exposed POST mutations without authorization. (OWASP A01:2021 Broken Access Control / CWE-352). Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: AI treats Next.js Server Actions like private internal functions, omitting session authentication and permitting unauthenticated public POST mutations. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	AI treats Next.js Server Actions like private internal functions, omitting session authentication and permitting unauthenticated public POST mutations.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

MUST check server session authentication (e.g. auth() / getServerSession()) as the very first line inside every Server Action.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.