Support · Security & data
Server-side request authentication
In modern React frameworks, server actions are public endpoints — anyone can post to them. FeeGuard treats every one as hostile until proven otherwise.
The rule
Every server action re-authenticates the session and re-authorises ownership from scratch, using server-side context only. Client-supplied arguments identify *what* to act on, never *who* is acting or *what they may* act on.
Why this matters concretely
A crafted request naming another organisation’s finding id fails ownership checks before any read. Forged role claims do nothing because roles come from the session, not the payload. The pattern eliminates an entire class of IDOR vulnerabilities structurally.