Building an AI-assisted Next.js app, you will hit the same fork: put the write behind a Route Handler, or call a Server Action from the form. Both are valid. Both fail in boring ways when you mix them without a checklist.

I use this six-point check before I ship. It is the same bar we use when Massvai generates a full-stack Next.js app so the auth and data path is not a toy.

1. Who owns the cookie jar?

Server Actions run in the same origin as your page. Route Handlers are often called from client fetch with credentials you forgot to set. If the session cookie never arrives, you get a 401 that looks like a bug in the action, not the fetch.

Check: open DevTools → Network → the failing request → Request Cookies. If the session cookie is missing, fix credentials / SameSite before you touch the handler.

2. CSRF is not optional on mutations

Browser-navigated Server Actions get Next.js CSRF protection for free. A public POST /api/... Route Handler does not. If your mutation is reachable cross-site, add an origin check or a CSRF token.

Check: from another origin, can you POST the same body and change data?

3. Streaming and timeouts

Long AI calls blow past serverless limits. A Server Action that waits on a 60s model call will time out on many hosts. Prefer a Route Handler that starts the job and returns an id, then poll or stream.

Check: what is your platform's max duration for the runtime you picked?

4. Validation belongs on the server twice

Client Zod is UX. Server Zod (or equivalent) is security. Whether you use an action or a handler, parse the body again on the server and reject unknown fields.

Check: send an extra field the client never shows. Does the server ignore or reject it?

5. Authz is not authn

getUser() is authentication. Authorization is "this user may edit this row". Put the ownership check next to the mutation, not only in middleware.

Check: call the mutation with a valid session for user A and an id owned by user B.

6. Logging without leaking prompts

Log request ids, user ids, and status codes. Do not log raw prompts, API keys, or full request bodies in production.

Check: grep your log drain for Authorization and prompt.

If you want a Next.js app that already wires auth, database, and UI with these checks in mind, try Massvai — an AI full-stack Next.js app builder. Built by the Massvai Team (support@massvai.com).