Server actions POST requests to wrong URL

[benjick]

Summary

Hi!

I have an api route: /api/chat (used for ai package with useChat).

I keep seeing data from other parts of my app being posted to this route, data which I only post to the backend via server actions. How can this happen? I can't replicate it locally, but I see it in my production logs every other day.

/api/chat is only mentioned a single time in my codebase, and that's in the useChat function.

next: 15.1.5
ai: 4.0.36

Additional information

No response

Example

No response

[icyJoseph]

Have you ever been able to see such requests leaving the browser in your network request? I interpret locally, as in a local production build, but in your deployed app?

Maybe you could try to capture some debug information, like user agent, path of origin, which headers are present, if any, it might explode your production logs though... or if you have this data already, are there any hints there?

[benjick]

Hey!

Thanks for replying.

I've not been able to replicate it myself locally, either in development mode or production build. I've not been able to replicate it in deployed production either. I just see the errors in my logs, so it's happening to real users.

I will add some debugging, cheers!