mirror of
https://github.com/hanzoai/next.js.git
synced 2026-09-24 17:00:51 +00:00
6fbff29a2e
Implementation of feature request opened here - https://github.com/vercel/next.js/discussions/59427 Approach: ~~We are using micromatch in the csrf protection step of actionHandler to allow for wildcard domains passed in allowedDomains. This is the same library used for matching domains for remote images.~~ If any of the allowed domains match the origin of the request, we skip the downstream error thrown for csrf protection. Edit: Micromatch is not available in this context as it is only compatible with Node. This codepath can be run from the edge, so we need to rely on vanilla js compatible code only. Instead of falling back to allowing the user to pass in a regex, which can be somewhat insecure, we opt into continuing to use a wildcard pattern from a configuration standpoint and instead use a simple function that matches on wildcards using string comparison and iteration. Ideally, Micromatch can be retrofitted to work in non-Node settings and this piece of code can be replaced in the future, without deprecating or changing the next.config interface. --------- Co-authored-by: Josh Story <[email protected]>
56 lines
1.6 KiB
Plaintext
56 lines
1.6 KiB
Plaintext
---
|
|
title: serverActions
|
|
description: Configure Server Actions behavior in your Next.js application.
|
|
---
|
|
|
|
Options for configuring Server Actions behavior in your Next.js application.
|
|
|
|
## `allowedOrigins`
|
|
|
|
A list of extra safe origin domains from which Server Actions can be invoked. Next.js compares the origin of a Server Action request with the host domain, ensuring they match to prevent CSRF attacks. If not provided, only the same origin is allowed.
|
|
|
|
```js filename="next.config.js"
|
|
/** @type {import('next').NextConfig} */
|
|
|
|
module.exports = {
|
|
experimental: {
|
|
serverActions: {
|
|
allowedOrigins: ['my-proxy.com', '*.my-proxy.com'],
|
|
},
|
|
},
|
|
}
|
|
```
|
|
|
|
## `bodySizeLimit`
|
|
|
|
By default, the maximum size of the request body sent to a Server Action is 1MB, to prevent the consumption of excessive server resources in parsing large amounts of data, as well as potential DDoS attacks.
|
|
|
|
However, you can configure this limit using the `serverActions.bodySizeLimit` option. It can take the number of bytes or any string format supported by bytes, for example `1000`, `'500kb'` or `'3mb'`.
|
|
|
|
```js filename="next.config.js"
|
|
/** @type {import('next').NextConfig} */
|
|
|
|
module.exports = {
|
|
experimental: {
|
|
serverActions: {
|
|
bodySizeLimit: '2mb',
|
|
},
|
|
},
|
|
}
|
|
```
|
|
|
|
## Enabling Server Actions (v13)
|
|
|
|
Server Actions became a stable feature in Next.js 14, and are enabled by default. However, if you are using an earlier version of Next.js, you can enable them by setting `experimental.serverActions` to `true`.
|
|
|
|
```js filename="next.config.js"
|
|
/** @type {import('next').NextConfig} */
|
|
const config = {
|
|
experimental: {
|
|
serverActions: true,
|
|
},
|
|
}
|
|
|
|
module.exports = config
|
|
```
|