Ask

is it normal that server actions post to the page url instead of an api route

The consequences are what matter:

  • You cannot curl it as an API and you should not try. If a mobile client or a third party needs to call it, write a route handler.
  • It is still a public endpoint. Anyone can craft that POST with any arguments. Do auth and ownership checks inside the action, not in the component that renders the button.
  • Middleware runs on it, same as any request.

39 · in/server-actions ·