API Route Handler Security

Next.js checks Origin for Server Actions. Move the same logic to a route handler and it stops.

The Origin check that makes Server Actions CSRF-resistant is a property of how Next.js dispatches them, not of your code. Refactor into app/api and you inherit the flexibility, not the check.