{"record":{"id":"99d25502632246c5","repo":"vercel/next.js","slug":"missing-origin-header-from-a-forwarded-server-ac","errorCode":null,"errorMessage":"Missing `origin` header from a forwarded Server Actions request.","messagePattern":"Missing `origin` header from a forwarded Server Actions request\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/next/src/server/app-render/action-handler.ts","lineNumber":681,"sourceCode":"  workStore.fetchCache = 'default-no-store'\n\n  const originHeader = req.headers['origin']\n  const originHost =\n    typeof originHeader === 'string'\n      ? // 'null' is a valid origin e.g. from privacy-sensitive contexts like sandboxed iframes.\n        // However, these contexts can still send along credentials like cookies,\n        // so we need to check if they're allowed cross-origin requests.\n        originHeader === 'null'\n        ? 'null'\n        : new URL(originHeader).host\n      : undefined\n  const host = parseHostHeader(req.headers)\n\n  let warning: string | undefined = undefined\n\n  function warnBadServerActionRequest() {\n    if (warning) {\n      warn(warning)\n    }\n  }\n  // This is to prevent CSRF attacks. If `x-forwarded-host` is set, we need to\n  // ensure that the request is coming from the same host.\n  if (!originHost) {\n    // This is a handcrafted request without an origin or a request from an unsafe browser.\n    // We'll let this through but log a warning.\n    // We can't guard against unsafe browsers and handcrafted requests can't contain\n    // user credentials that haven't been shared willingly.\n    warning = 'Missing `origin` header from a forwarded Server Actions request.'\n  } else if (!host || originHost !== host.value) {\n    // If the customer sets a list of allowed origins, we'll allow the request.\n    // These are considered safe but might be different from forwarded host set\n    // by the infra (i.e. reverse proxies).\n    if (isCsrfOriginAllowed(originHost, serverActions?.allowedOrigins)) {\n      // Ignore it\n    } else {\n      if (host) {","sourceCodeStart":663,"sourceCodeEnd":699,"githubUrl":"https://github.com/vercel/next.js/blob/43273a1d21a35646ec43230e05727e18ac258396/packages/next/src/server/app-render/action-handler.ts#L663-L699","documentation":"Validation in the Server Actions request handler (handleAction): forwarded Server Actions requests must carry an origin header so Next.js can perform origin/host checks that protect state-changing actions. The guard fires when the incoming request has no origin header at all (or it could not be parsed), leaving the action without a trustworthy origin to validate against the host header.","triggerScenarios":"Thrown at packages/next/src/server/app-render/action-handler.ts:682 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Send Server Action requests with the `origin` header; do not strip it in proxies.","Configure `experimental.serverActions.allowedOrigins` if forwarding through a proxy."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"43273a1d21a35646ec43230e05727e18ac258396","analyzedAt":"2026-08-19T02:10:13.922Z","contentChangedAt":"2026-08-19T02:10:13.922Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}