Add tryGetSession (or getSessionOrNull) that doesn't create a new entry in a database to SessionStorage interface

[tats-u]

getSession always runs createSession when readData cannot find a corresponding entry.
Another method that does not run createSession in such a case is required when you develop a member-only application and expose its login page to the public.
If createSession is called too many times (e.g. by DoS attack), the performance of a database can be degraded, especially when you use only RDBMS and do not combine it with KVS NoSQL (e.g. Redis/Valkey).

  getSession: (
    cookieHeader?: string | null,
    options?: ParseOptions
  ) => Promise<Session<Data, FlashData>>;

vs

  tryGetSession: (
    cookieHeader?: string | null,
    options?: ParseOptions
  ) => Promise<Session<Data, FlashData> | null>;

react-router/packages/react-router/lib/server-runtime/sessions.ts

Lines 266 to 270 in 255ac96

	async getSession(cookieHeader, options) {
	let id = cookieHeader && (await cookie.parse(cookieHeader, options));
	let data = id && (await readData(id));
	return createSession(data || {}, id || "");
	},

The current getSession will perform a wasteful operation even if an user has no merit to receive a session data.

vs

 async tryGetSession(cookieHeader, options) { 
   let id = cookieHeader && (await cookie.parse(cookieHeader, options)); 
   let data = id && (await readData(id)); 
   return data ? createSession(data, id) : null;
 }, 

As you might notice, it returns just null without creating new one when no entry.

const session = await tryGetSession(
  request.headers.get("Cookie"),
);
if (session == null) {
  return redirect("/login");
}

// Login page
const session = await tryGetSession(
  request.headers.get("Cookie"),
);
if (session != null) {
  return redirect("/");
}

This will not be a breaking change unless you use third party session libraries. However, an author of a third party session library have to modify their library to implement this method. Unfortunately JavaScript/TypeScript cannot provide default method implementations in an interface unlike Java or C#.

[tats-u]

Implementation:

dev...tats-u:react-router:session-get

[tats-u]

Creating a session when the user has no intention of logging in is a waste of resources.

[brophdawg11]

createSession does not touch the session backing store, it just creates a JS object implementing the Session interface:

react-router/packages/react-router/lib/server-runtime/sessions.ts

Line 93 in 6e0deab

export const createSession: CreateSessionFunction = <

I think what you're probably running into is calling commitSession on these "empty" sessions when you don't need to - that is what would create a new session in your DB:

https://github.com/remix-run/react-router/blob/6e0deabca97fc4816f0ad13d359bf316e04e500f/packages/react-router/lib/server-runtime/sessions.ts#L271-287

You can check session.id to see if it's a new session (id === "") or existing session (id is populated) and potentially use that along with a check on session.data to see if any data has been added to the session before calling commitSession.