Next.js Discord

Discord Forum

Best practices for authorizing server actions

Unanswered
Saltwater Crocodile posted this in #help-forum
Open in Discord
Saltwater CrocodileOP
Hi, I have a middleware in nextjs that authorizes users, and redirects them to the correct page if they try to access unauthorized pages.

If a logged out user tries to access any page aside from the login page they are redirected
if a normal user tries to access pages under /admin they are redirected to their user portal

Inside my pages like /admin/users and /admin/deals I have server actions to mutate data
I noticed that the server actions run on the same URL as the page that's calling them, for example the action inside the deals page has this url /admin/deals?rsc=W78UG-asdf2123F so I thought maybe I could remove the authorization check inside my server action since that check does the same thing as the one inside my middleware but I am not sure if I am missing something

1 Reply