Security

Security & Server Actions

eQuantic.UI facilitates communication between the client and the server through Server Actions, while ensuring that this bridge is secure by default.

⚡ Server Actions

A Server Action is a C# method defined in a component that can be invoked directly from the browser. The compiler automatically generates the call bridge (Fetch API) and the server middleware resolves the execution.

Example:

[ServerAction]
[Authorize(Roles = "Admin")]
public async Task<bool> DeleteUser(Guid userId) {
    // Logic executed only on the server
}

🛡️ Protection Layers

1. Authorization (RBAC)

eQuantic.UI supports [Authorize] and [AllowAnonymous] attributes.

• The ServerActionsMiddleware checks if the current user has the necessary permissions before invoking the method.
• If authorization fails, the server returns a 403 Forbidden or 401 Unauthorized error, blocking the execution of the business logic.

2. Payload Validation

To prevent injection attacks and excess resource consumption:

• Size Limit: The middleware imposes strict limits on the size of the request body.
• Type Whitelist: Argument deserialization is restricted to known and secure types, preventing insecure deserialization attacks.

3. Action Registration

Only methods explicitly marked with [ServerAction] can be invoked. It is not possible to call any arbitrary public method via API, ensuring that the attack surface is controlled.

📡 Communication Protocol

Communication is done via HTTP POST to the reserved endpoint /_equantic/action.

• Payload: Contains the unique Action ID and the list of serialized arguments.
• Response: Returns the result object or a structured error.