React Server Components: secure patterns in production
Server fetch, data boundaries, and avoiding secret leaks in RSC.
React Server Components (RSC) promise less client JS — San Juan teams adopt Next.js App Router without understanding server components can still leak data with wrong design. OWASP warns about sensitive data exposure; an RSC passing full user object to child client component exposes internal fields in bundle.
Secure pattern: fetch in server component with auth check in same boundary; pass client only minimal serializable DTO. Never import modules with secrets in files eventually referenced from 'use client'. The AWS Security Blog applies the same principle in Lambda — minimum data privilege per layer.
Validation: Zod in server action and server component loader; reject input before DB query. SQL injection in RSC is as real as in API routes — ORMs do not save raw queries in route handlers. Rate limit server actions mutating state — they are endpoints without visible URL but equally attackable.
Dangerous caching: aggressive revalidatePath may serve user A data to user B with misconfigured cache keys — use cache: 'no-store' on authenticated data until mastering semantics. Smashing Magazine covers RSC performance; complement with data flow threat modeling.
Audit bundle: search API keys and PII in client chunks with source-map-explorer. Bruce Schneier recommends assuming everything sent to client is public — RSC does not change that rule, only reduces volume. Secure production in PR requires RSC code review checklist on every PR with auth or PII.
Operations and execution — connecting strategy with what the team ships every week.
