Does a server component or server action automatically protect data?
Answer out loud or in your head first, then compare.
Answer
No. Running code on the server helps hide secrets and database connection code, but the server can still return data to an unauthorised person. I have to check the user and their right to the specific object.
I treat a function called from the browser as an entry point into the backend: I don't trust its arguments just because they came from our form. A server action also needs data and access checks. Conversely, a client component is needed for some interactions, but that doesn't mean it never takes part in preparing the view on the server. The details depend on the router and Next version used.
Why it matters: Access to data has to be checked beyond hiding buttons in the UI.
Possible follow-ups: What if someone calls the action without using our form?
How did it go? Be honest — “Not yet” puts the question on your review list.
Start with
- C-P01 · What is React, and what is a component? — React, Next.js and frontend
- C-P02 · How do props and state differ? — React, Next.js and frontend
- C-P04 · What is useEffect for, and what does the dependency array mean? — React, Next.js and frontend
Further reading
- Next.js: Caching and Revalidating (Previous Model)(opens in a new tab)Docs; accessed 22.10.2026. Depends on the router, version and Cache Components; there is no single rule for all of Next.