Return client errors for unrecognized Server Actions - #98123
Merged
Conversation
Return 400 for malformed Server Action reference IDs and 409 for well-formed references that are unavailable in the current deployment. Preserve the worker response status when forwarding action requests, and cover apps both with and without Server Actions. <!-- NEXT_JS_LLM -->
Contributor
Tests PassedCommit: 59b08ae |
Classify action IDs embedded in multipart form submissions before React decodes them. Return 400 for malformed IDs and 409 for unavailable well-formed IDs instead of rethrowing them as 500 errors. Add Node and Edge coverage for direct and bound MPA action encodings. <!-- NEXT_JS_LLM -->
Keep multipart action validation boolean instead of returning an error/status tuple. Inline the HTTP mapping at the Node and Edge response boundaries: malformed payloads return 400, while module-map misses throw and return 409. This keeps status codes out of the ID validator and avoids allocating a result container on valid requests. <!-- NEXT_JS_LLM -->
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Derive the status of marked forwarded action responses from the original Server Action ID. This preserves 409 for well-formed stale references when a mixed-version worker returns 404, and prevents an unexpected upstream 200 from being treated as success. <!-- NEXT_JS_LLM -->
This comment has been minimized.
This comment has been minimized.
Require callers to classify unrecognized Server Action requests before handling the response. Header actions derive their status from the header ID, while MPA validation retains its explicit malformed-versus-missing classification. <!-- NEXT_JS_LLM -->
Return generic, status-matched bodies for unrecognized Server Action requests. Malformed IDs receive an invalid-request body, while unavailable well-formed IDs receive an unavailable-action body. <!-- NEXT_JS_LLM -->
eps1lon
reviewed
Sep 3, 2026
Run deployed MPA Server Action assertions for malformed and unavailable IDs. Keep only runtime log expectations local because deployment logs are unavailable. <!-- NEXT_JS_LLM -->
eps1lon
approved these changes
Sep 3, 2026
5 tasks
This was referenced Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
400 Bad Requestwhen a Server Action reference ID does not match the expected format409 Conflictwhen a well-formed action ID is unavailable in the current deployment, including deployment skewNext-Actionheader and multipart MPA forms, including direct and bound actions in Node and Edge runtimesFetch actions previously had dedicated 404 handling, while equivalent MPA form submissions fell through to the generic error path and returned 500. This removes that transport-dependent behavior and distinguishes malformed or scanning traffic from legitimate stale clients without treating either case as a missing page or an internal server failure.
Verification
pnpm test-dev-turbo test/e2e/app-dir/actions-unrecognized/actions-unrecognized.test.tspnpm test-dev-turbo test/e2e/app-dir/actions/app-action.test.ts -t 'forward.*action'pnpm test-start-turbo test/e2e/app-dir/actions-unrecognized/actions-unrecognized.test.tspnpm test-dev-webpack test/e2e/app-dir/actions-unrecognized/actions-unrecognized.test.tspnpm test-dev-turbo test/e2e/app-dir/no-server-actions/no-server-actions.test.ts