HTML attributes for client-side form validation
HTML attributes required and type="email" can be used for basic client-side form validation. These provide built-in browser validation without additional libraries.
Next.js · Guides · all subjects
input validation & security
6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Use schema validation libraries for server-side validation
For server-side form validation, use a schema validation library like Zod or Valibot. These allow you to define validation schemas and safely parse form data, returning errors in a structured format that can be displayed to the user.
Server-side validation with Zod example
'use server' import { z } from 'zod' const schema = z.object({ email: z.string({ invalid_type_error: 'Invalid Email', }), }) export default async function createUser(formData: FormData) { const validatedFields = schema.safeParse({ email: formData.get('email'), }) if (!validatedFields.success) { return { errors: validatedFields.error.flatten().fieldErrors, } } // Mutate data } This example shows how to validate form data using Zod and return errors in a structured format.
Local images with query strings require localPatterns.search configuration
Local image sources with query strings now require images.localPatterns.search configuration to prevent enumeration attacks. If you need to use query strings with local images like /assets/photo?v=1, add the pattern to your next.config with pathname and search properties.
Local IP restriction for image optimization
A new security restriction blocks local IP optimization by default in Next.js 16. Set images.dangerouslyAllowLocalIP to true only for private networks. This is necessary when hosting Next.js in a VPC with split-horizon DNS, but only enable after understanding the SSRF risk.
Form validation with Zod schema example
Use schema validation libraries like Zod, Valibot, or Yup to validate form fields on the server. Example with Zod: name field requires minimum 2 characters with trim(), email field requires valid email with trim(), password field requires minimum 8 characters with at least one letter, one number, and one special character, with trim().