Backport Next.js changes to v14.2.34 (#29)
* remove urlencoded server action handling (#14)
* remove urlencoded server action handling
* urlencoded POSTs should still flow through action handler
* bailout early for urlencoded
* tweak handling to 404 in feetch action case
* error when there are no server actions (#15)
* remove custom error
* remove dev gate
* error when there are no server actions
* gate against dev
* Check whether action ids are valid before parsing (#16)
* Check whether action ids are valid before parsing
In an effort to narrow access to parsing methods Next.js now prequalifies MPA form parsing by ensuring there are only valid action IDs as part of the submission. This is not meant to be a strong line of defense against malicious payloads since action IDs are not private and are for many apps relatively easy to acquire. It does however provide some limited narrowing of code paths so that action decoding only happens for plausible actions
Additionally all other branches that use next-action header now consistently check the header before proceeding with parsing. This is also a perf improvement.
* fix test assertion
---------
Co-authored-by: Zack Tanner <1939140+ztanner@users.noreply.github.com>
* fix test
---------
Co-authored-by: Josh Story <story@hey.com>
