vercel/next.js · error

Missing `origin` header from a forwarded Server Actions requ

Error message

Missing `origin` header from a forwarded Server Actions request.

What it means

Validation in the Server Actions request handler (handleAction): forwarded Server Actions requests must carry an origin header so Next.js can perform origin/host checks that protect state-changing actions. The guard fires when the incoming request has no origin header at all (or it could not be parsed), leaving the action without a trustworthy origin to validate against the host header.

Source

Thrown at packages/next/src/server/app-render/action-handler.ts:681

  workStore.fetchCache = 'default-no-store'

  const originHeader = req.headers['origin']
  const originHost =
    typeof originHeader === 'string'
      ? // 'null' is a valid origin e.g. from privacy-sensitive contexts like sandboxed iframes.
        // However, these contexts can still send along credentials like cookies,
        // so we need to check if they're allowed cross-origin requests.
        originHeader === 'null'
        ? 'null'
        : new URL(originHeader).host
      : undefined
  const host = parseHostHeader(req.headers)

  let warning: string | undefined = undefined

  function warnBadServerActionRequest() {
    if (warning) {
      warn(warning)
    }
  }
  // This is to prevent CSRF attacks. If `x-forwarded-host` is set, we need to
  // ensure that the request is coming from the same host.
  if (!originHost) {
    // This is a handcrafted request without an origin or a request from an unsafe browser.
    // We'll let this through but log a warning.
    // We can't guard against unsafe browsers and handcrafted requests can't contain
    // user credentials that haven't been shared willingly.
    warning = 'Missing `origin` header from a forwarded Server Actions request.'
  } else if (!host || originHost !== host.value) {
    // If the customer sets a list of allowed origins, we'll allow the request.
    // These are considered safe but might be different from forwarded host set
    // by the infra (i.e. reverse proxies).
    if (isCsrfOriginAllowed(originHost, serverActions?.allowedOrigins)) {
      // Ignore it
    } else {
      if (host) {

View on GitHub (pinned to 43273a1d21)

Solutions

1. Send Server Action requests with the `origin` header; do not strip it in proxies.
2. Configure `experimental.serverActions.allowedOrigins` if forwarding through a proxy.

When it happens

Trigger: Thrown at packages/next/src/server/app-render/action-handler.ts:682 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of vercel/next.js@43273a1d21 (2026-08-19). Data as JSON: /api/errors/99d25502632246c5. Report an issue: GitHub.