A Server Action is a C# method defined in a component that can be invoked directly from the browser. The compiler automatically generates the call bridge (Fetch API) and the server middleware resolves the execution.

Example:

[ServerAction]

[Authorize(Roles = "Admin")]

public async Task<bool> DeleteUser(Guid userId) {

// Logic executed only on the server

}

🛡️ Protection Layers

1. Authorization (RBAC)

eQuantic.UI supports [Authorize] and [AllowAnonymous] attributes.

•

The ServerActionsMiddleware checks if the current user has the necessary permissions before invoking the method.

•

If authorization fails, the server returns a 403 Forbidden or 401 Unauthorized error, blocking the execution of the business logic.

2. Payload Validation

To prevent injection attacks and excess resource consumption:

•

Size Limit: The middleware imposes strict limits on the size of the request body.

•

Type Whitelist: Argument deserialization is restricted to known and secure types, preventing insecure deserialization attacks.

3. Action Registration

Only methods explicitly marked with [ServerAction] can be invoked. It is not possible to call any arbitrary public method via API, ensuring that the attack surface is controlled.

📡 Communication Protocol

Communication is done via HTTP POST to the reserved endpoint /_equantic/action.

•

Payload: Contains the unique Action ID and the list of serialized arguments.

•

Response: Returns the result object or a structured error.

PREVIOUSBunPackage

NEXTImage

ON THIS PAGE

⚡ Server Actions