Next.js security tip: Use "server only" for the code that should never be exposed to the client.

Never understood why server only is a package and not a directive.

This is really good, it's surprising that among all of talk about security concerns about RSCs and Server Actions in Next.js I've never heard about this.

Here is a great in-depth article about security in Next.js

The fact that it is even possible to accidentally ship sensitive server code to the client is a huge red flag. 🚩🚩🚩

it's very easy to get confused by "use server" and `import "server-only"`. Now I have 3 different function files to help me, post.server.ts(using server-only), post.action.ts(using "use server") and post.ts(the functions that can be called by server or client components)

in a few years I swear we are going to go full circle again back to client server separation as the latest fad

Nice one...thanks

That's a crucial tip! Keeping sensitive code on the server side is essential for protecting your application. It helps ensure that no confidential data is exposed to users. Thanks for sharing this important reminder!

We need "use security" directive ASAP😁

Wish this was a directory like with sveltekit