Server-side security in Next.js rests on the principle that all client code is visible and modifiable. Secrets stay in server code, inputs are validated, and authentication and authorization are checked on every data access, in Server Actions and Route Handlers as well as in pages.
Example
Check the user's session and permissions in every Server Action, not only in the interface.