React's most dangerous feature

Stop using top-level use server in Next.js applications, as it inadvertently exposes all functions as public endpoints that can be hit by users without inherent access controls 0:00.

Key Takeaways:
• The use server directive effectively acts as a door opening functions to the client, meaning every function must be individually authenticated and authorized 0:10.
• The Next.js compiler exposes unexported functions found within imported files as endpoints, creating hidden security risks even if the developer intends to use the code only internally 2:07.
• Context variables defined during a component's render are embedded into form payloads by default, which can leak sensitive data (like random tokens) if not properly encrypted 2:10.
• Developers must enforce strict patterns, such as using ESLint rules to ban top-level directives, organizing files into dedicated "data" folders, and conducting rigorous code reviews 8:00.

[Treating these server actions as backend API endpoints is essential, as the risk of data leakage remains significant unless developers actively verify user permissions for every function 0:32.]

Sources:

• 0:00 Intro warning about data leaks and "top level use server".
• 0:10 Explanation of how use server acts as a door to server functions.
• 2:07 Discussion on how the compiler exposes functions even if not used.
• 2:10 Illustration of context variables (like random numbers) leaking into form data.
• 8:00(https://www.y