Server Action auth guard — every Server Action needs session check

What it is

Server Actions are Next.js's mechanism for client-to-server RPC. Just because they run server-side doesn't mean they're authenticated by default.

Vulnerable example

"use server";
export async function transferFunds(toUserId: string, amount: number) {
  // No session check — any caller (logged-in or not) can transfer funds
  await db.transfer({ from: "???", to: toUserId, amount });
}

Fixed example

"use server";
import { auth } from "@/auth";
export async function transferFunds(toUserId: string, amount: number) {
  const session = await auth();
  if (!session) throw new Error("unauthenticated");
  // Plus authorization: confirm the from-account belongs to this session
  const fromAccount = await db.accounts.findOne({ userId: session.user.id });
  if (!fromAccount) throw new Error("forbidden");
  await db.transfer({ from: fromAccount.id, to: toUserId, amount });
}

How Securie catches it

"use server";
import { auth } from "@/auth";
export async function transferFunds(toUserId: string, amount: number) {
  const session = await auth();
  if (!session) throw new Error("unauthenticated");
  // Plus authorization: confirm the from-account belongs to this session
  const fromAccount = await db.accounts.findOne({ userId: session.user.id });
  if (!fromAccount) throw new Error("forbidden");
  await db.transfer({ from: fromAccount.id, to: toUserId, amount });
}

Checklist

• const session = await auth() at top of every action
• if (!session) throw — fail-closed
• Authorization check after authentication
• Re-MFA for high-risk actions
• Audit log every state change

FAQ

Related guides