Which statement about Server Action security is correct? (Next.js interview question)

Actions are reachable through POST requests, so each one must check authentication and authorization and validate its input

Each action is reachable through a POST request, so it is in effect a public HTTP endpoint. Anyone can call it with crafted arguments. Next.js adds some protections: action IDs that can't be guessed, removal of unused actions, and Origin header checks against CSRF (Cross-Site Request Forgery: another site tricking the browser into sending a request). But authorization and input validation are your job. The tempting "Actions can only be called by components that import them" is wrong, because anyone can send that POST request directly.

Data security (https://nextjs.org/docs/app/guides/data-security)nextjs.org