flawopen.com/Reference/Next.js Server Actions CSRF

Are Next.js Server Actions safe from CSRF?

Framework Security Guide

Short answer

Yes, by default. Next.js Server Actions verify the Origin header against the Host header on all POST requests. If an attacker's site tries to trigger a server action on behalf of a logged-in user, Next.js blocks the request automatically.

How Next.js Protects Server Actions

When a Next.js Server Action is invoked, the browser sends an HTTP POST request. Next.js checks whether the incoming Origin header matches the application's Host header. If they do not match, the action is rejected with a 403 Forbidden error.

When the Protection Can Break

Misconfigured allowedOrigins in next.config.js

If you specify wildcards or trust external subdomains in experimental.serverActions.allowedOrigins, a compromised subdomain can issue cross-site action calls.

Reverse Proxy Host Header Spoofing

If your reverse proxy (Nginx, AWS ALB) forwards an untrusted X-Forwarded-Host header to Next.js without validation, the Origin check can be deceived.

Prevention Checklist

✓Ensure your reverse proxy sets X-Forwarded-Host and Host strictly to verified domain names.
✓Never use wildcards in allowedOrigins.
✓Ensure authentication cookies use SameSite=Lax or SameSite=Strict.