Why server action request use "content-type: text/plain", this will cause the default WAF rule block the request.

[youweol-master]

I'm using the nextjs framework with nginx + modsecurity in front of it.

I've found the ServerAction request is send http POST request use "content-type: text/plain" header, but not "content-type: application/json"

nextjs fetchServerAction() src code

due to the document from coreruleset

Content-Types that a client is allowed to send in a request.
Default: |application/x-www-form-urlencoded| |multipart/form-data| |text/xml|
|application/xml| |application/soap+xml| |application/json|

Please note, that the rule where CRS uses this variable (920420) evaluates it with operator
@Within, which is case sensitive, but uses t:lowercase. You must add your whole custom
Content-Type with lowercase.

Bypass Warning: some applications may not rely on the content-type request header in order
to parse the request body. This could make an attacker able to send malicious URLENCODED/JSON/XML
payloads without being detected by the WAF. Allowing request content-type that doesn't activate any
body processor (for example: "text/plain", "application/x-amf", "application/octet-stream", etc..)
could lead to a WAF bypass. For example, a malicious JSON payload submitted with a "text/plain"
content type may still be interpreted as JSON by a backend application but would not trigger the
JSON body parser at the WAF, leading to a bypass.

When additional JSON content types are legitimately used in a deployment,
e.g. application/cloudevents+json, it is extremely important to ensure that a
rule exists to enable the engine's JSON body processor for these additional
JSON content types. Failure to do so can lead to a request body bypass. The
default JSON rule in modsecurity.conf-recommended (200001) will only activate
the JSON body processor for the specific content type application/json. The
optional modsecurity.conf-recommended rule 200006 can be used to enable the
JSON body processor for a wide variety of JSON content types.

with the default WAF configure, it will block POST with request "content-type: text/plain".
I suggest the fetchServerAction src code should add "content-type: application/json" header.

[icyJoseph]

Answered this here: #72961 (comment)

Repeating for future reference:

Server Actions are a React feature, and changes to their mechanics, ought to be suggested over there at their repository, however, we can of course, explore and learn together, about them here at Next.js' side.

Server Actions, not used directly in forms, use content-type: text/plain, because, they support more formats than just json. For completeness sake, form submissions use multipart/form-data.