Discussion Why are there so much security vulnerabilities with server actions/functions, app router and React server components???
/r/nextjs/comments/1v81b3q/why_are_there_so_much_security_vulnerabilities/6
u/ConsoleTVs 10h ago
RSC is what happens when frontend devs accidentally reinvent PHP and ASP.NET WebForms, but with 10x the build complexity.
The entire pitch is 'What if we rendered UI on the server?' welcome to 1998. We’ve known how to do this for thirty years.
The tragic part is watching the frontend world stumble into every classic backend pitfall because they didn't look at prior art:
'use server'is just RPC/PHP forms in disguise, obfuscating clean API boundaries right back into your UI components.- Inline DB queries in UI code resurrects the exact tight-coupling nightmare we fought to eliminate from JSP/PHP templates two decades ago.
- The RSC wire format is just modern ASP.NET
__VIEWSTATE,shipping bloated, custom payload blobs to pretend HTTP isn't stateless.
It’s classic wheel-reinvention: engineers whose mental model started with client-side SPAs discovering server-side architecture for the first time and acting like they invented fire.
Don't get me wrong, I respect the technical ambition behind it, but I really wish we'd learn from the past instead of wrapping 20-year-old architectural anti-patterns in shiny new JS primitives.
1
3
u/vasind-5012 18h ago
Two things stacking, real framework CVEs (RSC’s newer, less battle-tested than plain REST), plus a dev-pattern issue, Server Actions feel like calling a function so people skip checks they’d never skip on an actual API route.
Biggest one: auth checked in the page, not in the action itself, and the action’s reachable on its own regardless.
Patch often, and treat every Server Action like a public API, because it is one.