Next.js penetration testing: Security assessment for React server applications

Akande Simpa Lead Security Engineer & Cofounder, Simpa Labs CEH (Certified Ethical Hacker)

1. Server Actions authorization testing

Server Actions are async functions defined with the 'use server' directive. When called from a Client Component, Next.js exposes them as HTTP POST endpoints with a generated URL. The key finding we look for is Server Actions that perform data mutations without verifying the current user's authorization:

// VULNERABLE Server Action: no authorization check
'use server'

export async function updateUserTier(userId: string, tier: number) {
  // Flaw: any authenticated user can upgrade any other user's tier
  await db.user.update({ where: { id: userId }, data: { tier } });
}

We call every Server Action directly using HTTP POST requests crafted in Burp Suite, bypassing the React component UI. This confirms whether authorization is enforced at the action layer or only in the client-side component logic that invokes it (which is trivially bypassed).

2. Next.js middleware bypass

Next.js middleware runs at the edge before a request reaches a page or API route. It is commonly used to check session cookies and redirect unauthenticated users. A critical class of bypass occurs when the middleware matches routes using string patterns that do not cover all routes that need protection. We have found cases where middleware protected /dashboard but not /dashboard.json, /dashboard/ (trailing slash), or API routes under the dashboard path that return the same sensitive data.

3. Environment variable exposure in client bundles

We inspect every Next.js production build's client-side JavaScript chunks for NEXT_PUBLIC_ prefixed variables. Finding a variable like NEXT_PUBLIC_PAYSTACK_SECRET_KEY in a production bundle is a critical finding that requires immediate remediation. We also inspect next.config.js for the env block, which can inadvertently expose server-only variables to the client runtime if the configuration is authored incorrectly.

4. API Route authorization

Next.js API routes (under pages/api/ or app/api/) are HTTP endpoints. We test every API route for: missing authentication middleware, Broken Object Level Authorization (where one user can fetch another user's data by changing an ID parameter), HTTP method restrictions (does a GET-only route accept POST requests?), and rate limiting enforcement on high-frequency sensitive endpoints.

5. Incremental Static Regeneration (ISR) cache poisoning

ISR allows Next.js pages to regenerate statically in the background. If a page's static regeneration path includes user-controlled data (such as a user profile slug that renders into a statically cached page), an attacker may be able to manipulate a cached page's content. We test ISR-enabled pages for paths where the cached output includes data derived from untrusted input sources.

Related reading

Blog: Next.js Server Actions deep dive · React SPA security testing · API data leaks

Services: Penetration testing · API security testing