Auth
These guides are about who is allowed to call a route. Hiding a button does not stop the request. A Server Action is a public POST. An id in the URL is not proof that the signed-in user owns that row. Password reset and login also need a real limit, because an open route will accept as many tries as a script sends.
Guides
Auth checked only in the UI
Hiding a button or a page does not stop a request. The server, the database policy, or both have to reject it.
Server Actions with no auth check
A Server Action is a public POST. 'use server' does not mean only your button can call it.
IDOR: reading or changing someone else's data
The request carries an id, and the server fetches that id without checking that it belongs to the signed-in user.
Weak password reset
A reset flow that uses a short code, a guessable link, or a client-only check lets someone take the account without the password.
No rate limiting on auth or paid API routes
Login, password reset, and any route that calls a paid API will accept as many requests as an attacker sends, until the bill or the user list gives out.
Questions
If the page redirects when I am logged out, is the API safe?
Not by itself. Open the network panel, copy the request, and send it without the session cookie. A private read should return 401 or 403. If it returns the data, the check lived in the page and not on the server.
Do Server Actions need their own auth check?
Yes. The directive marks a function the client may call. It does not look up the session for you. Load the session inside the action and ignore a user id that arrived in the form.
What does an IDOR check look like?
Sign in as a second test user and change the id in the URL or the request body to the first user's id. You should get a refusal, not their row. The server has to compare the row's owner with the session.
Is a short email code a fine password reset?
A short numeric code is easy to guess if the route has no limit. Use the auth provider's email flow, or a long single-use token, and rate limit the route. Do not set a new password from an email address alone.