Next.js Server Actions include a built-in cross-site request forgery (CSRF) safeguard, but that does not automatically protect custom Route Handlers or Pages API routes in the same application. For cookie-authenticated endpoints that change data, assess and implement a CSRF defense for each route. In every entry point, authenticate and authorize the operation and validate client input.
What protection do Next.js Server Actions provide?
Server Actions are invoked with POST requests. Next.js compares the request’s Origin header with the Host header or, when present, X-Forwarded-Host; it rejects requests when those origins do not match. Next.js describes this as additional CSRF protection. Its Data Security guide states: “As an additional protection, Server Actions in Next.js also compare the Origin header to the Host header (or X-Forwarded-Host).”
As an Amazon Associate I earn from qualifying purchases.
This is a safeguard at the Server Action boundary, not a guarantee that every CSRF risk in an application has disappeared. It does not replace authorization, input validation, or careful handling of other HTTP endpoints.
Recommended Free Tools
Configure trusted origins carefully behind a proxy
A reverse proxy can make the browser-visible host differ from the host seen by the Next.js server. If that causes legitimate Server Action requests to fail the origin check, configure only the additional trusted origins the application needs, using the Server Actions configuration. Ensure the proxy’s forwarded host information is trustworthy; a forwarded header should not be treated as reliable merely because it is present.
#1 Best Overall
Why custom API routes have a separate CSRF boundary
Route Handlers and legacy Pages API routes are independent HTTP entry points. They do not inherit the Server Action origin comparison just because they are part of the same Next.js app. A route that changes server-side state and accepts ambient browser credentials—typically session cookies—needs its own threat assessment and appropriate protection.
CSRF exploits the browser’s tendency to attach credentials such as cookies to a request, even when a user is induced to visit or interact with another site. The relevant questions are how the endpoint is reached, what credentials the browser sends automatically, and whether the request can cause a state change. A service authenticated only by a bearer token explicitly supplied in an Authorization header has a different classic cookie-based CSRF profile; document the actual credential flow rather than applying a blanket rule. Authorization, input validation, and cross-origin policy still matter.
Rank #2
| Entry point | Framework-provided CSRF safeguard | What the application author must do |
|---|---|---|
| Server Action | POST invocation and Origin-to-Host or X-Forwarded-Host comparison, with mismatches rejected. | Authenticate and authorize each operation, validate all client input, and configure trusted origins carefully if the deployment’s proxy arrangement requires it. |
| Custom Route Handler or Pages API route | The Server Action check does not apply automatically. | Assess whether the endpoint changes state and relies on ambient cookies; add a suitable CSRF defense when that threat applies, alongside authentication, authorization, and validation. |
Choose a CSRF defense that fits the route
For cookie-authenticated custom endpoints, use a deliberate defense rather than relying on the framework’s treatment of a different entry point. OWASP’s Cross-Site Request Forgery Prevention Cheat Sheet describes several approaches.
Free tools Windows power users keep installed
One-click scans. No signup required.
Stateful sessions: synchronizer token
For an application with server-side session state, OWASP recommends the synchronizer token pattern. The server issues a token associated with the user’s session, and the state-changing request returns it in a request location the server validates, such as a form field or header. A value appearing only in a cookie is not enough: the server must validate an appropriate token or equivalent defense rather than accepting a cookie’s presence as proof.
Stateless sessions: signed, session-bound double-submit
Where the architecture is stateless, OWASP recommends a properly signed double-submit token bound to session-specific data. Avoid a naive design that merely checks whether two submitted values are equal; cookie injection can undermine that approach. The server must verify the signature and session binding.
API-driven clients: require a custom header
An API designed for clients that make explicit requests can require a custom header and enforce that requirement server-side. This can be useful because a cross-site HTML form cannot ordinarily set an arbitrary custom header. It is not a substitute for checking the real authentication flow, authorization, or input. Pair it with Origin or Fetch Metadata checks where appropriate.
Rank #4
Use browser and HTTP controls as defense in depth
- Keep safe methods safe. GET, HEAD, and OPTIONS should not change application state. Mutations belong behind methods and checks intended for state-changing operations.
- Set cookie SameSite deliberately. SameSite can reduce some cross-site cookie sending, but OWASP treats it as defense in depth, not a complete CSRF policy. Cookie scope and deployment details can affect its behavior.
- Check Origin and Fetch Metadata where suitable. These signals can help reject unwanted cross-site requests, but they should be applied in a way that accounts for legitimate clients and the deployed proxy setup.
- Do not mistake CORS for a CSRF defense. CORS governs whether browser scripts can read cross-origin responses and, in some cases, whether a preflighted request proceeds. It does not by itself stop every cross-site request that can trigger a state change.
Secure the operation inside every entry point
Next.js advises developers to treat Server Actions as public-facing endpoints. The same practical discipline belongs in custom handlers: page visibility, a hidden button, or a client-side guard is not endpoint authorization. Check the identity and permission needed for the specific operation where that operation executes, and validate values supplied by the client.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Inventory mutations. List every state-changing Server Action, Route Handler, and Pages API route, including older endpoints that remain deployed.
- Map credentials and behavior. For each endpoint, record whether the browser sends cookies automatically, whether a bearer credential is explicitly attached, and which methods can change state.
- Apply endpoint-level access checks. Authenticate and authorize inside the action or handler itself; do not rely on a gated page or hidden control.
- Validate every client-controlled value. Check submitted fields, route parameters, headers, and other values against expected formats, ranges, and permissions.
- Select and enforce a CSRF defense for cookie-authenticated mutations. Use a synchronizer token for stateful sessions, a signed session-bound double-submit design for stateless architectures, or an appropriate required-header pattern for API-driven clients. Add Origin and Fetch Metadata checks where they fit.
- Review safe methods, cookies, and proxy headers. Keep GET, HEAD, and OPTIONS free of mutations; choose SameSite settings deliberately; and ensure the deployed proxy supplies trustworthy host information.
- Test the deployed boundary. Exercise cross-origin requests against the actual public host and proxy arrangement, and verify both expected rejection and legitimate requests.
What is established—and what is not
The cited guidance establishes the Server Action origin check and recommends protections for CSRF-prone application endpoints; it does not provide a measured effectiveness statistic or prove that any one defense makes all applications safe. The Next.js Server Actions configuration page is labeled last updated February 27, 2026. The OWASP cheat sheet’s publication date is not stated in the available page information. The controls above therefore describe documented safeguards and design guidance, not a claim that a particular deployment has been tested.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
