Server actions, content type?

[anton-johansson]

Summary

We've been exploring Server Actions for a bit. When we deploy our application behind an NGINX with ModSecurity enabled, we realized that it's blocked by this rule:
https://github.com/coreruleset/coreruleset/blob/main/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf#L993

It seems like the Server Actions are called by POST'ing data to the server. The data seems to be in JSON format, an array of parameters. But the Content-Type header is text/plain;charset=UTF-8. Is this intended? Is there any reason why it couldn't be application/json?

Thanks in advance!

Additional information

No response

Example

No response

[icyJoseph]

It depends... I think if you submit a form then it uses, multipart/form-data,, for example:

import { foo } from './actions'

export default function Home() {
  return (
  <form action={foo}>
      <button type="submit">go</button>
    </form>
  );
}

Has these headers:

But this:

'use client'
import {foo} from './actions'

export default function Home() {
  return (
      <button  onClick={() => foo()}>go</button>
  );
}

Has the headers you report:

I think those are the cases. We'd need to loop in React here, since Server Actions are a React feature...

[icyJoseph]

And I guess they use that content type because server actions support more types than what the JSON format does.

As client code calls the Server Action over the network, any arguments passed will need to be serializable.

• https://react.dev/reference/rsc/use-server#serializable-parameters-and-return-values

[anton-johansson]

Sorry for the late reply. Thank you both for your answers! I guess we'll simply live with turning off that ModSecurity config. :D

[revoltez]

why not allow modifying the Content-Type instead?