Next.js Server Actions Have Built-In CSRF Protection. Your API Routes Probably Don't.

I wrote a post a while back about Server Actions being public, directly callable endpoints regardless...