How Server Actions work
At the top of a file, the 'use server' directive marks every function in the file as server-side; inline at the top of a single function, it marks only that function. Server Actions cannot be defined inside Client Components, so a Client Component imports them from a file that starts with 'use server'. Server Actions are sent as HTTP POST requests, and POST is the only method that can invoke them.
No JavaScript needed. Forms in Server Components that call Server Actions still submit when JavaScript has not loaded or is disabled.
One at a time. The Next.js client dispatches Server Actions one at a time, so
Promise.alldoes not run them in parallel. The server does not queue them.One request. When an action triggers an immediate revalidation, Next.js runs the action and re-renders the current route in one HTTP request, so the return value and the new RSC Payload arrive together.
Cookies. Setting or deleting a cookie inside a Server Action makes Next.js re-render the current page and its layouts on the server.
The Next.js 14 announcement showed that a Server Action can also be called directly as a function, without a form, which gives end-to-end type safety in TypeScript.
Security and limits
Any client can call a Server Action with a direct POST request, outside the app's UI, so each one needs its own authentication and authorization check.
CSRF. Next.js compares the request's
Originheader with theHostorX-Forwarded-Hostheader and rejects mismatches;serverActions.allowedOriginsadds extra trusted hosts.Body size. Request bodies are limited to 1MB by default, and
serverActions.bodySizeLimitraises the limit.Encryption. Next.js encrypts action references at build time and strips unused actions from client bundles, so unused functions get no public endpoint. Variables captured by inline actions are encrypted too, and self-hosted or multi-instance deployments should set
NEXT_SERVER_ACTIONS_ENCRYPTION_KEYto one stable key shared by all instances.Deployments. Action IDs usually change with each deployment and rotate at least every 14 days, so a client on an old build can hit a "Failed to find Server Action" error.
Cache tags.
updateTagexpires a cache tag immediately for read-your-own-writes and can only be called from Server Actions.
The Next.js Server Actions guide documents each option.
What Pagepro checks in every Server Action
After a Pages Router to App Router migration, Pagepro gives every Server Action that infers a record from the route its own test. Each action also re-checks the user's entitlements on the server, because a crafted request can skip the UI gate. For an audit of an existing App Router app, see Next.js project rescue.
Sources
- Server Actions and MutationsNext.js · nextjs.org
- Mutating DataNext.js · nextjs.org
- serverActionsNext.js · nextjs.org
- use serverNext.js · nextjs.org
- Next.js 14Next.js · nextjs.org