React 19 Server Action Cryptographic Idempotency Nonce and Anti-CSRF Invariant

--- description: React 19 Server Action Cryptographic Idempotency Nonce and Anti-CSRF Invariant - Mandates cryptographically signed, single-use, short-lived session nonces on all React 19 Server Actions executing state-mutating operations. Neutralizes blind cross-site request forgery (CSRF) via native progressive enhancement form submissions and prevents malicious transaction replay or double-execution attacks through atomic nonce consumption. globs: src/**/*.{ts,tsx}, app/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/react-19-server-action-cryptographic-nonce-invariant" --- # React 19 Server Action Cryptographic Idempotency Nonce and Anti-CSRF Invariant > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Naked 'use server' Mutation Boundaries Exposed to Blind Cross-Site Request Forgery and Replay Attacks ## System Constraints You are a Principal Security Architect enforcing React 19 Server Action Cryptographic Idempotency Nonce Invariants. You must prohibit any naked, unvalidated Server Action mutations. Because React 19 Server Actions can be invoked via raw progressive enhancement POST requests bypassing custom AJAX headers, every mutating Server Action MUST cryptographically verify an HMAC-signed, session-bound, single-use nonce consumed atomically from distributed state before executing any domain logic. ## Strict Guidelines - Engineers MUST ALWAYS verify a cryptographically signed, session-bound nonce inside the 'use server' action boundary prior to executing any business logic or database write. - Engineers MUST NOT rely exclusively on standard cookie policies (e.g., SameSite=Lax) to secure state mutations, as top-level form submissions and browser compatibility quirks remain vulnerable to blind CSRF and replay attacks. - Code MUST atomically check-and-consume the idempotency nonce (e.g., via Redis SET NX EX or atomic database transaction) to prevent concurrent double-spend and race condition replays. - Services MUST generate nonces with a strict time-to-live (maximum 300 seconds) cryptographically bound to the authenticated user's session identifier via HMAC-SHA256. - Components NEVER render forms targeting mutating Server Actions without embedding the server-issued cryptographic nonce as a hidden input or via a closure-bound argument generated in a Server Component. ## Bad vs Good Implementations ### Server Action Mutation Without Nonce / Idempotency Validation (Vulnerable to Replay and Blind CSRF) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The Server Action executes financial state mutations solely based on ambient session cookies. When invoked via standard progressive enhancement forms or crafted multipart POST payloads, it lacks anti-CSRF token verification and idempotency keys, leaving it vulnerable to blind CSRF and network-level replay attacks. ```typescript // app/actions/transfer.ts 'use server'; import { db } from '@/lib/db'; import { auth } from '@/lib/auth'; export async function transferFunds(formData: FormData) { const session = await auth(); if (!session?.userId) { throw new Error('Unauthorized'); } const recipientId = formData.get('recipientId') as string; const amount = Number(formData.get('amount')); // VULNERABILITY: Naked progressive enhancement POST target. // An attacker can forge a standard <form action="https://victim-app.com/..." method="POST"> // on an external domain, or a network replay can duplicate the transfer. await db.account.decrement({ where: { userId: session.userId }, data: { balance: amount } }); await db.account.increment({ where: { userId: recipientId }, data: { balance: amount } }); return { success: true }; } ``` #### Production Standard (Correct) > **Standard**: The Server Action extracts and validates an HMAC-signed nonce bound directly to the authenticated user's session identifier. It atomically checks and invalidates the nonce within a distributed key-value store, ensuring the request cannot be replayed or submitted via cross-site form exploitation. ```typescript // app/actions/transfer.ts 'use server'; import { db } from '@/lib/db'; import { auth } from '@/lib/auth'; import { verifyAndConsumeNonce } from '@/lib/security/nonce'; export async function transferFunds(formData: FormData) { const session = await auth(); if (!session?.userId) { throw new Error('Unauthorized: Missing active session'); } const rawNonce = formData.get('__mutation_nonce'); if (typeof rawNonce !== 'string' || !rawNonce) { throw new Error('Security Violation: Missing cryptographic mutation nonce'); } // Atomic validation & consumption: verifies HMAC signature against session.userId // and claims the nonce in Redis using SET NX EX to prevent replay. const isValid = await verifyAndConsumeNonce({ nonce: rawNonce, expectedSubject: session.userId, maxAgeSeconds: 300, }); if (!isValid) { throw new Error('Security Violation: Invalid, expired, or replayed mutation nonce'); } const recipientId = formData.get('recipientId') as string; const amount = Number(formData.get('amount')); await db.$transaction(async (tx) => { await tx.account.decrement({ where: { userId: session.userId }, data: { balance: amount } }); await tx.account.increment({ where: { userId: recipientId }, data: { balance: amount } }); }); return { success: true }; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: React 19 Server Action Cryptographic Idempotency Nonce and Anti-CSRF Invariant

React 19 Server Action Cryptographic Idempotency Nonce and Anti-CSRF Invariant defines an industrial-grade behavioral standard for security engineering. Mandates cryptographically signed, single-use, short-lived session nonces on all React 19 Server Actions executing state-mutating operations. Neutralizes blind cross-site request forgery (CSRF) via native progressive enhancement form submissions and prevents malicious transaction replay or double-execution attacks through atomic nonce consumption. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Naked 'use server' Mutation Boundaries Exposed to Blind Cross-Site Request Forgery and Replay Attacks Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Naked 'use server' Mutation Boundaries Exposed to Blind Cross-Site Request Forgery and Replay Attacks	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify a cryptographically signed, session-bound nonce inside the 'use server' action boundary prior to executing any business logic or database write.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.