Question 1

What are Server Actions?

Accepted Answer

Async server functions that can be invoked from Client Components/forms, marked with 'use server'. They simplify mutations without hand-written API routes for first-party UI. Can be progressive-enhancement friendly with forms. Still require authz and validation.

Question 2

How do you bind a Server Action to a form?

Accepted Answer

Pass the action to <form action={serverAction}> or use useActionState/useFormStatus patterns. Works without client JS for basic progressive enhancement. Prefer validated FormData parsing. Revalidate caches after mutation.

Question 3

What security issues exist with Server Actions?

Accepted Answer

They are callable endpoints — must authenticate, authorize, validate inputs, and protect against CSRF/origin issues as designed by the framework version. Never trust client-sent IDs for ownership. Apply same rules as API routes. Avoid exporting overly broad server functions.

Question 4

How do Server Actions integrate with caching?

Accepted Answer

After mutations call revalidatePath/revalidateTag or update tags so UI reflects new data. Forgetting revalidation is a common bug ('submit worked but list stale'). Also consider optimistic UI on the client.

Question 5

Server Action vs Route Handler for file uploads?

Accepted Answer

Either can work; actions integrate with forms, handlers may fit external clients and streaming uploads better. Watch body size limits and runtime constraints. Validate MIME/size server-side. Store in object storage, not disk on ephemeral hosts.

Question 6

How do you handle validation errors in Server Actions?

Accepted Answer

Return structured error objects / useActionState; don't only throw opaque errors. Map field errors for UX. Log unexpected exceptions. Keep messages safe for end users.

Question 7

Lead: standardize Server Action usage across teams.

Accepted Answer

Conventions for 'use server' file placement, zod schemas, auth guards, revalidation helpers, and observability. Create shared action wrappers that enforce authz + logging. Ban ad-hoc DB calls from random client components without review.

Server Actions Next.js Interview Questions

Other Next.js interview topics