Server Actions Are Public Endpoints: Auditing RSC Trust Boundaries
A Server Action is an RPC endpoint with a URL, registered at build time, reachable without a session, and dispatched before your code runs. This short walks the request path from the Next-Action header through Flight decoding and the server reference manifest, then shows where the authorization check actually belongs. The source post is careful about what the 2026-11-09 RCE report establishes and what it does not: no CVE, no version range, no exploit detail. So the video stays on the part you can act on today, which is the shape of the trust boundary every React Server Components deployment exposes. Action IDs are stored as literal strings in the client JavaScript you ship, and middleware matchers are written against page paths, not action endpoints. The audit steps are inventory work: grep your build output for action IDs, POST each one without a session, compare your matchers to the paths actions arrive on, and take version ranges from the React and Next.js advisories rather than from a headline. Full write-up: https://hackyjs.com/posts/server-actions-and-flight-endpoints-auditing-rsc-trust-boundaries-after-the-authless-rce-report