React's most dangerous feature

It pains me how little people understand "use server". Enough so to trigger a rant. Ugh. Hope this helps. Server components are DIFFERENT, not HARD.

SOURCES

S/O Ph4se0n3 for the awesome edit 🙏

[LadyEmilyNyx]

I'm primarily a backend dev, and so I am always extremely careful about auditing what any external api's do. I did not, however, realise that every "use server" was in effect creating another api. Now if you'll excuse me, I have several codebases to audit.
Thanks for the heads up.

[zactron]

Inplicitly creating endpoints is the problem. The more things you make implicit in a framework, the greater the opportunity for a nightmare to be created.

[kylemichaelsullivan]

"When you're exposing things with 'use server', you have to assume that th[e] function can be run by anybody. I think a lot of the issue that's happening here is that web developers aren't used to dealing with access control."

Great video, as always, but IMHO, this is the TL:DR of this video, and maybe it's worth its own reel/short.

[RhysSullivan]

As of 8/22 the Next team has put out a fix for this issue via tree shaking unused action ids, and I think it’s being backported to v14

There’s a deeper problem imo around the design of having implicit endpoint creation, but it’s nice this specific problem is fixed

[James-rybo]

RSC is such a developer experience disaster. Too much magic and confusion of where your code runs. Having concrete application boundaries is a good thing!

[MilesFlavel]

I feel like "use server" should have some sort of mandatory access level argument

[yashkhambhatta]

Theo the type of guy to explain a problem for 10 minutes only to be like : " yeah so we ARENT gonna talk about this actually, this is completely different"

[RoyaltyInTraining.]

JS devs seem so odd to me sometimes. They berate people for using HTMX cause it breaks separation of concerns, but then they just blatantly throw server side code into their client side files?

[steverude]

Maybe they should invent an HTTP header for Authorization. They mustn’t have thought about it…

[ventic]

Part of the issue here is overloading the export keyword to mean two different things: to create an endpoint and to allow it to be called from other modules. I feel like it's an unnecessary footgun in the design.

[ventic]

25:15 if code review is your only line of defence against something, you're not well defended against it, because for a ton of people it's "just a job" and they don't care to fully understand every detail in changes they review; mistakes and oversights are a big reason for security breaches.

[monad_tcp]

They basically recreated AspNet WebForms.
It only took 15 years and the pendulum came back to server components entangled .

[DarkSwordsman]

How long until NextJS reinvents Express middleware? :)

Also, isn't one of the top engineering rules in *any* system to default to a safe or secure mode? Like railroad crossings defaulting to enabled, or door magnets turning off with loss of power?
Shouldn't it be defaulting to not exposing your endpoints unless you tell it to?

[lidinzx]

I kind of understand the use of "use server", but is kind of complex to maintaining as the app keeps growing, I prefer a separated backend, and not doing sql querys inside the actions, instead calling my backend that needs authorization that don't care about the exposes endpoints on nextjs, that way, I don't have to worry about those security issues that next js has.

[BobKane-gx]

I don't know, man; it looks leakier than my 43-year-old toilet in my apartment. There's no way every developer can keep up with every exposed point.

[echobucket]

NextJS suffers from the same thing most large web frameworks do. Complexity. In an effort to make things "easier" they've actually made it very complex. So much so that people often do incorrect things because they don't really understand the complexity.

[memeteamdreamteam]

React keeps making various forms of useEffect footguns lol

[bosung]

In our team, we always end our filename with .server for server run code. For example, actions.server.ts

[PpVolto]

Everyone says controll your Access but everyone falls short of Showing how to do it correctly. My loved example is a Company Blog system, one user writes a Article and sets the state to review and then a other user can change/publish the Article. Not to simple and not to Complex to show every Access Controll you need. The best part is how you design the Article flow changes the AccessControll

[khaled_osman]

separation of concerns went from html and css in js, to backend in frontend really quick. what a mess.