new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Next.js · Guides · all subjects

authorization/server-actions

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Verify authentication and authorization in Server Actions

Authentication and authorization should be verified inside each Server Action. Do not rely on Proxy, layout, or page level checks alone. Database access should be moved to a server-only Data Access Layer, and rate limiting should be considered for expensive operations.

Authorization checks in Server Components

In Server Components, use verifySession() to check the user's role and conditionally render components. For example, check if userRole === 'admin' or userRole === 'user' and render appropriate components, or redirect unauthorized users.

Authorization checks in Server Actions

Treat Server Actions with the same security considerations as public-facing API endpoints. Call verifySession() to get the session, check the user's role, and return early if the user is not authorized to perform the action. Proceed only for authorized users.

Authorization checks in Route Handlers

Treat Route Handlers with the same security considerations as public-facing API endpoints. Call verifySession() to verify authentication and role. Return 401 status if not authenticated, 403 status if authenticated but lacking permissions.

Auth checks in page and leaf components

Perform auth checks in page components to verify the session and fetch user-specific data. Also perform checks in leaf components to conditionally render UI elements like admin-only actions. Ensure Server Actions called from these components also perform their own authorization checks.

Authorization checks prevent IDOR vulnerabilities

Beyond authentication (is the user logged in?), always check authorization (does this user have permission to act on this specific resource?). Verify that the user owns or has permission to modify the resource being accessed to prevent Insecure Direct Object Reference (IDOR) vulnerabilities.

Give your agent this brain