require-action-input-schema

Why it matters

Astro Actions are public endpoints. An input schema rejects malformed or unexpected request data before it reaches application logic and gives the handler typed input.

See the difference

export const server = {
  createUser: defineAction({
    handler: async (input) => createUser(input),
  }),
}

import { z } from 'astro:schema'

export const server = {
  createUser: defineAction({
    input: z.object({
      email: z.string().email(),
    }),
    handler: async ({ email }) => createUser({ email }),
  }),
}

Configure this check

Project audits are configured in doctor.config.ts:

export default {
  rules: {
    'astro-doctor/require-action-input-schema': 'error',
  },
}

Use 'error', 'warn', or 'off'. The configuration guide covers presets and per-file overrides.

Keep exploring security

• no-set-htmlAvoid set:html to prevent cross-site scripting (XSS) vulnerabilities.
• no-public-secret-envWarn when PUBLIC_ environment variables appear to contain secrets.
• no-disabled-origin-checkKeep Astro's built-in CSRF origin check enabled.
• no-insecure-session-cookieKeep secure, HTTP-only, same-site session cookie protections enabled.
• no-open-allowed-domainsConfigure explicit trusted host patterns instead of allowing every domain.

Browse every rule and project audit