Allow server actions to return a different HTTP status

[rclmenezes]

Goal

Server actions should be able to return different HTTP statuses, like a 400 or 401.

Background

Currently, server actions return an HTTP 200 on success and an HTTP 500 on error.

They can also return a 301 via the redirect function and a 404 via the notFound` function.

However, it would be nice to support other status codes:

• 401 -- Most server actions will probably require authentication
• 400 / 422 -- There are some checks you can only support on the server

Returning an Http500 feels wrong in these scenarios. I want to be able to monitor my 40X responses.

Also, many people automate alerting on 500s; I don't want to get a Sentry alert whenever a script kiddie horses around with my endpoints.

Proposal

Two possible solutions:

1. Add new functions for these status codes

These new functions could work like redirect or notFound:

• notAuthorized would return a NEXT_NOT_AUTHORIZED error
• badRequest would return a NEXT_BAD_REQUEST error

This is probably the easiest solution. But what if we wanted to return something weird like a 402 or a 418? Are we going to make a function for each one? Ew.

2. Allow server actions to throw a custom error. For example:

throw HttpError({
    body: { errors: [{ field: "email", "Email is a required field" },
    status: 400
});

We can implement this by returning a NEXT_CUSTOM_HTTP error object, and store statusCode as an attribute, and body as another attribute.

(While I have this soapbox, I dislike that the redirect and notFound functions throw the error for you. I'd much rather explicitly call throw redirect('/blah') instead of redirect('/blah').)

[ricardo-fnd]

any news on this @rclmenezes

[rclmenezes]

I don't work for Vercel my dude

[RemyMachado]

@rclmenezes Have you been hired yet? I need some news on this.

[juanmagalhaes]

I miss something like this too. Also the last time I tried on next 13.4 if I threw inside a server action locally would be fine but in production mode it would replace the message from the Error with a default one (Need to see if this is still a thing in 13.6)

[mcfry]

Would be nice to get a response on this

[nateeo]

Sveltekit handles it pretty nicely, and it would be amazing to have in Next.js: https://kit.svelte.dev/docs/errors. Something that might be good with a proposal like this is the handleError hook they provide, that allows you to modify/log any unexpected error before returning it to the client.

[mordechaim]

I would really love to have something like this.
@leerob Any chance to see this implemented in the future?

[RinNguyens]

:D Still waiting any one suggestion

[Akshit1311]

I'm hoping for something similar, need to send a 401 not sure how to do it using server actions, don't wanna spin up an API route just for this

[elja]

If you just need to have a custom reaction on your client based on the status code or work with complex errors responses, then you can return a simple JSON object from your server action that will represent the success and failure state, and then use this on the client. For example inside a failure key you can have a status code key with a 422 value or errors, for example, you can throw your custom error. Generally speaking, it's up to you to define some data protocol that would serialize/deserialize your responses from server action to the client.

[bchenSyd]

is this the reason why it's impossible?

Server Actions integrate with the Next.js caching and revalidation architecture. When an action is invoked, Next.js can return both the updated UI and new data in a single server roundtrip.

so that "single server routrip" contains both server action result and UI updates; so can't have status code (or custom http header)

[aprilmintacpineda]

Still not possible today on [email protected] :( I resorted to throw new Error('ErrorCode'), unbeknownst to me, on production build, these throw new Error behaves differently, because during development we actually are able to get the error message on the frontend, but on build, the error message is somehow overridden by Next: Error: An error occurred in the Server Components render. The specific message is omitted in production builds to avoid leaking sensitive details. A digest property is included on this error instance which may provide additional details about the nature of the error.. This leaves us with the only option of returning an object with statusCode in it but it won't be accurate because the real http response code would be 200 but the intended statusCode is going to be like 401 or 403 or 400.

[6TELOIV]

A thrown error will be caught by the nearest error boundary, which lets you display a nice message.

[Moemen12]

Still the same :) ?

[arturbartolelli]

need it too

[stnguyen90]

I'd also like to be able to control the status code because I think password managers will see the 200 status code and think authentication was successful and ask to save the password.

[elja]

Surprisingly, there is no official answer yet. Does anyone know if it is even on the roadmap? We had to get rid of server-side actions because of multiple issues and pure support (e.g., implementing CSRF protection for SSA looks horrible, or not being able to return custom HTTP status codes, etc.). We started to use APIs instead, maybe I'll try SSA again but only for form submission.

[leerob]

Have you seen this re: CSRF? https://nextjs.org/blog/security-nextjs-server-components-actions#csrf

[mordechaim]

@leerob while you're here, I believe I have a very clean solution. The very next section from that link you posted discusses error handling.

The current paradigm to handle errors with a special json body is a mess, perhaps having a special ActionError() would behave differently by not hashing the message and return an error 400 instead.

This way server actions can deal with errors in a much more ergonomic way (errors bubble up on the server) and not losing the error message on production, at the same time it will return status 400 which solves the current issue.

[leerob]

Related: there's been some exploration into forbidden() or notAuthorized().

• Introduce Forbidden and the UI Error abstraction #65993
• Introduce experimental Request Interceptors #70961

What could be helpful here: what are the product requirements you are trying to achieve with the status code? Is there a tool your customers are using which expect to see such code? Or something else? The more specific the better 😄

[dugajean]

I offload authentication to a server action, which in turn sends a request to my auth server. This allows me to set the refresh token as a HTTPS cookie. If the user provides invalid credentials, then a 400 would be expected.

[modnarlluf]

I added some telemetry, and I can't easily filter the "reals server errors" (500) and the "server-side validation errors" (400) on my traces.

[sventore]

Login server action with rate limit, should be able to return status 429

[empz]

Also looking for this. For example, when using Arcjet to protect Server Actions, it would be nice to have a way to return the right status code. If it's rate limited 429, if it's something else like a bot 403, and so on.

[GaonLabs]

It would be nice if I can just throw any custom exception, but maybe I can set statusCode as 401 or 403 within that exception and it returns that code instead of 500.