Server Functions and security: every "use server" is a public endpoint

Arjun’s profile page calls a Server Function with the user’s id. It only ever sends the signed-in user’s id, so he skipped the permission check. Someone changed the id in a copied request and edited other users’ profiles.

A Server Function, marked with "use server", runs on the server but can be called from the client. Under the hood, the framework turns it into an HTTP endpoint. Anyone can call it with any arguments; your UI is not a security layer. When used as a form action, it is called a Server Action.

So every Server Function needs the same checks as an API route: who is calling, are the arguments valid, and is this user allowed to do this to this record? That last check is authorization:

"use server";
import { z } from "zod";
const Input = z.object({ userId: z.number(), name: z.string().trim().min(1).max(50) });

export async function updateProfile(raw) {
  const session = await getSession();                  // who is calling?
  if (!session) throw new Error("Not signed in");
  const input = Input.parse(raw);                      // never trust the shape
  if (input.userId !== session.userId && session.role !== "admin") throw new Error("Forbidden");
  await db.user.update(input.userId, { name: input.name }); // only allowed fields
}