---
title: "Server Action writes without an auth check (next/server-action-auth)"
description: "Every exported Server Action is a public POST endpoint that anyone can call with any arguments; the page that renders the form is not a guard."
url: http://localhost:4173/rules/next/server-action-auth
updated: 2026-11-11
---

# Server Action writes without an auth check

> `next/server-action-auth` is a vetd rule. It flags: Server Action writes without an auth check. It runs on every `check`, together with the TypeScript check.

| Fact | Value |
| --- | --- |
| Rule id | `next/server-action-auth` |
| Severity | warning |
| Group | Server code: security and speed |
| Tags | security, nextjs-16 |

## Why it matters

Every exported Server Action is a public POST endpoint that anyone can call with any arguments; the page that renders the form is not a guard.

## How to fix it

Check the session/user (and that they own the record) at the top of the action, before the write.

## Credit

Based on work by:

- [Next.js team](https://nextjs.org): Treat Server Actions like public API endpoints: authenticate and authorize inside each action.
- [OWASP](https://owasp.org): Broken access control is the top web application risk; authorization must be enforced server-side on every request.

## References

- [How to Think About Security in Next.js](https://nextjs.org/blog/security-nextjs-server-components-actions), Next.js
- [How to think about data security in Next.js](https://nextjs.org/docs/app/guides/data-security), Next.js
- [How to implement authentication in Next.js](https://nextjs.org/docs/app/guides/authentication), Next.js
- [Redirecting...](https://top10.owasp.org/A01_2021-Broken_Access_Control/), OWASP

## See it

Demos in the vetd Lab:

- [Auth inside every action](http://localhost:4173/lab/react-perf/authenticate-inside-server-actions)
- [Least privilege, every request](http://localhost:4173/lab/web-standards/least-privilege-access-control)

## Related rules

- [`next/server-actions`](http://localhost:4173/rules/next/server-actions.md)

## Get this text from vetd

MCP: call `explain` with `{ "diagnosticId": "next/server-action-auth" }`. CLI: `npx vetd explain next/server-action-auth`.

---

[All 92 rules](http://localhost:4173/rules.md) · Previous: [`next/no-head-in-app`](http://localhost:4173/rules/next/no-head-in-app.md) · Next: [`next/module-state`](http://localhost:4173/rules/next/module-state.md)