react-router 7.15.1 → 7.17.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (157) hide show
  1. package/CHANGELOG.md +27 -2
  2. package/dist/development/{browser-3AnU12UI.d.mts → browser-CGcs-0pD.d.mts} +2 -2
  3. package/dist/development/{browser-BOdXz9dK.d.ts → browser-D3uq9sI1.d.ts} +2 -2
  4. package/dist/development/{chunk-4N6VE7H7.mjs → chunk-6CSD65Y2.mjs} +12 -11
  5. package/dist/development/{chunk-RJYABSBD.mjs → chunk-ASILSGTR.mjs} +6 -6
  6. package/dist/development/{chunk-D6LUOGOQ.js → chunk-KFNXW4AL.js} +10 -10
  7. package/dist/{production/chunk-Y6IFXO7V.js → development/chunk-PBLBZ3QU.js} +7 -7
  8. package/dist/development/{chunk-66UKHEGQ.js → chunk-PULC7NLK.js} +100 -99
  9. package/dist/{production/context-ByvtofY2.d.mts → development/context-CmHpk1Ws.d.mts} +3 -3
  10. package/dist/development/{data-BqZ2x964.d.ts → data-D4xhSy90.d.ts} +1 -1
  11. package/dist/{production/data-BVUf681J.d.mts → development/data-U8FS-wNn.d.mts} +1 -1
  12. package/dist/development/dom-export.d.mts +4 -4
  13. package/dist/development/dom-export.d.ts +4 -4
  14. package/dist/development/dom-export.js +30 -30
  15. package/dist/development/dom-export.mjs +5 -5
  16. package/dist/{production/index-react-server-client-BS5F89FR.d.ts → development/index-react-server-client-CwU9bE5R.d.ts} +4 -4
  17. package/dist/{production/index-react-server-client-DY04-103.d.mts → development/index-react-server-client-DPrDrCew.d.mts} +3 -3
  18. package/dist/development/index-react-server-client.d.mts +3 -3
  19. package/dist/development/index-react-server-client.d.ts +3 -3
  20. package/dist/development/index-react-server-client.js +4 -4
  21. package/dist/development/index-react-server-client.mjs +2 -2
  22. package/dist/development/index-react-server.d.mts +1 -1
  23. package/dist/development/index-react-server.d.ts +1 -1
  24. package/dist/development/index-react-server.js +1 -1
  25. package/dist/development/index-react-server.mjs +1 -1
  26. package/dist/development/index.d.mts +18 -12
  27. package/dist/development/index.d.ts +18 -12
  28. package/dist/development/index.js +89 -89
  29. package/dist/development/index.mjs +3 -3
  30. package/dist/{production/instrumentation-cRWWLfsU.d.ts → development/instrumentation-1q4YhLGP.d.ts} +2 -2
  31. package/dist/development/lib/types/internal.d.mts +2 -2
  32. package/dist/development/lib/types/internal.d.ts +2 -2
  33. package/dist/development/lib/types/internal.js +1 -1
  34. package/dist/development/lib/types/internal.mjs +1 -1
  35. package/dist/development/{register-Bsscfj79.d.ts → register-CNAx3TXj.d.ts} +1 -1
  36. package/dist/development/{register-Df8okEea.d.mts → register-CqK96Zfk.d.mts} +1 -1
  37. package/dist/production/{browser-3AnU12UI.d.mts → browser-CGcs-0pD.d.mts} +2 -2
  38. package/dist/production/{browser-BOdXz9dK.d.ts → browser-D3uq9sI1.d.ts} +2 -2
  39. package/dist/production/{chunk-6S4627ZB.mjs → chunk-5TQZEVD5.mjs} +6 -6
  40. package/dist/{development/chunk-4YRVXM2U.js → production/chunk-CTIXC7EV.js} +7 -7
  41. package/dist/production/{chunk-PNZCCTKT.js → chunk-EN242BO4.js} +100 -99
  42. package/dist/production/{chunk-JAKZPQZC.mjs → chunk-OSYEOCBT.mjs} +12 -11
  43. package/dist/production/{chunk-HUBUW7R3.js → chunk-RTRY3JFT.js} +10 -10
  44. package/dist/{development/context-ByvtofY2.d.mts → production/context-CmHpk1Ws.d.mts} +3 -3
  45. package/dist/production/{data-BqZ2x964.d.ts → data-D4xhSy90.d.ts} +1 -1
  46. package/dist/{development/data-BVUf681J.d.mts → production/data-U8FS-wNn.d.mts} +1 -1
  47. package/dist/production/dom-export.d.mts +4 -4
  48. package/dist/production/dom-export.d.ts +4 -4
  49. package/dist/production/dom-export.js +30 -30
  50. package/dist/production/dom-export.mjs +5 -5
  51. package/dist/{development/index-react-server-client-BS5F89FR.d.ts → production/index-react-server-client-CwU9bE5R.d.ts} +4 -4
  52. package/dist/{development/index-react-server-client-DY04-103.d.mts → production/index-react-server-client-DPrDrCew.d.mts} +3 -3
  53. package/dist/production/index-react-server-client.d.mts +3 -3
  54. package/dist/production/index-react-server-client.d.ts +3 -3
  55. package/dist/production/index-react-server-client.js +4 -4
  56. package/dist/production/index-react-server-client.mjs +2 -2
  57. package/dist/production/index-react-server.d.mts +1 -1
  58. package/dist/production/index-react-server.d.ts +1 -1
  59. package/dist/production/index-react-server.js +1 -1
  60. package/dist/production/index-react-server.mjs +1 -1
  61. package/dist/production/index.d.mts +18 -12
  62. package/dist/production/index.d.ts +18 -12
  63. package/dist/production/index.js +89 -89
  64. package/dist/production/index.mjs +3 -3
  65. package/dist/{development/instrumentation-cRWWLfsU.d.ts → production/instrumentation-1q4YhLGP.d.ts} +2 -2
  66. package/dist/production/lib/types/internal.d.mts +2 -2
  67. package/dist/production/lib/types/internal.d.ts +2 -2
  68. package/dist/production/lib/types/internal.js +1 -1
  69. package/dist/production/lib/types/internal.mjs +1 -1
  70. package/dist/production/{register-Bsscfj79.d.ts → register-CNAx3TXj.d.ts} +1 -1
  71. package/dist/production/{register-Df8okEea.d.mts → register-CqK96Zfk.d.mts} +1 -1
  72. package/docs/explanation/backend-for-frontend.md +50 -0
  73. package/docs/explanation/code-splitting.md +61 -0
  74. package/docs/explanation/concurrency.md +135 -0
  75. package/docs/explanation/form-vs-fetcher.md +292 -0
  76. package/docs/explanation/hot-module-replacement.md +137 -0
  77. package/docs/explanation/hydration.md +14 -0
  78. package/docs/explanation/index-query-param.md +86 -0
  79. package/docs/explanation/index.md +4 -0
  80. package/docs/explanation/lazy-route-discovery.md +78 -0
  81. package/docs/explanation/location.md +6 -0
  82. package/docs/explanation/progressive-enhancement.md +150 -0
  83. package/docs/explanation/race-conditions.md +88 -0
  84. package/docs/explanation/react-transitions.md +160 -0
  85. package/docs/explanation/route-matching.md +7 -0
  86. package/docs/explanation/server-client-execution.md +4 -0
  87. package/docs/explanation/sessions-and-cookies.md +465 -0
  88. package/docs/explanation/special-files.md +16 -0
  89. package/docs/explanation/state-management.md +524 -0
  90. package/docs/explanation/styling.md +87 -0
  91. package/docs/explanation/type-safety.md +82 -0
  92. package/docs/how-to/accessibility.md +44 -0
  93. package/docs/how-to/client-data.md +199 -0
  94. package/docs/how-to/data-strategy.md +317 -0
  95. package/docs/how-to/error-boundary.md +231 -0
  96. package/docs/how-to/error-reporting.md +142 -0
  97. package/docs/how-to/fetchers.md +307 -0
  98. package/docs/how-to/file-route-conventions.md +410 -0
  99. package/docs/how-to/file-uploads.md +217 -0
  100. package/docs/how-to/form-validation.md +120 -0
  101. package/docs/how-to/headers.md +164 -0
  102. package/docs/how-to/index.md +4 -0
  103. package/docs/how-to/instrumentation.md +556 -0
  104. package/docs/how-to/meta.md +40 -0
  105. package/docs/how-to/middleware.md +763 -0
  106. package/docs/how-to/navigation-blocking.md +233 -0
  107. package/docs/how-to/optimize-revalidation.md +12 -0
  108. package/docs/how-to/pre-rendering.md +225 -0
  109. package/docs/how-to/presets.md +103 -0
  110. package/docs/how-to/react-server-components.md +899 -0
  111. package/docs/how-to/resource-routes.md +126 -0
  112. package/docs/how-to/route-module-type-safety.md +100 -0
  113. package/docs/how-to/search-params.md +4 -0
  114. package/docs/how-to/security.md +30 -0
  115. package/docs/how-to/server-bundles.md +66 -0
  116. package/docs/how-to/spa.md +120 -0
  117. package/docs/how-to/status.md +63 -0
  118. package/docs/how-to/suspense.md +132 -0
  119. package/docs/how-to/using-handle.md +117 -0
  120. package/docs/how-to/view-transitions.md +237 -0
  121. package/docs/how-to/webhook.md +50 -0
  122. package/docs/index.md +39 -0
  123. package/docs/start/data/actions.md +138 -0
  124. package/docs/start/data/custom.md +198 -0
  125. package/docs/start/data/data-loading.md +44 -0
  126. package/docs/start/data/index.md +4 -0
  127. package/docs/start/data/installation.md +52 -0
  128. package/docs/start/data/navigating.md +12 -0
  129. package/docs/start/data/pending-ui.md +12 -0
  130. package/docs/start/data/route-object.md +268 -0
  131. package/docs/start/data/routing.md +281 -0
  132. package/docs/start/data/testing.md +8 -0
  133. package/docs/start/declarative/index.md +4 -0
  134. package/docs/start/declarative/installation.md +43 -0
  135. package/docs/start/declarative/navigating.md +133 -0
  136. package/docs/start/declarative/routing.md +237 -0
  137. package/docs/start/declarative/url-values.md +65 -0
  138. package/docs/start/framework/actions.md +174 -0
  139. package/docs/start/framework/data-loading.md +201 -0
  140. package/docs/start/framework/deploying.md +96 -0
  141. package/docs/start/framework/index.md +4 -0
  142. package/docs/start/framework/installation.md +41 -0
  143. package/docs/start/framework/navigating.md +182 -0
  144. package/docs/start/framework/pending-ui.md +142 -0
  145. package/docs/start/framework/rendering.md +59 -0
  146. package/docs/start/framework/route-module.md +527 -0
  147. package/docs/start/framework/routing.md +362 -0
  148. package/docs/start/framework/testing.md +133 -0
  149. package/docs/start/index.md +4 -0
  150. package/docs/start/modes.md +201 -0
  151. package/docs/upgrading/component-routes.md +363 -0
  152. package/docs/upgrading/future.md +280 -0
  153. package/docs/upgrading/index.md +4 -0
  154. package/docs/upgrading/remix.md +403 -0
  155. package/docs/upgrading/router-provider.md +442 -0
  156. package/docs/upgrading/v6.md +382 -0
  157. package/package.json +2 -1
@@ -0,0 +1,160 @@
1
+ ---
2
+ title: React Transitions
3
+ ---
4
+
5
+ # React Transitions
6
+
7
+ [MODES: framework, data, declarative]
8
+
9
+ <br/>
10
+ <br/>
11
+
12
+ [React 18][react-18] introduced the concept of "transitions" which allow you to differentiate urgent from non-urgent UI updates. To learn more about React Transitions and "concurrent rendering" Please refer to React's official documentation:
13
+
14
+ - [What is Concurrent React][concurrent]
15
+ - [Transitions][transitions]
16
+ - [`React.useTransition`][use-transition]
17
+ - [`React.startTransition`][start-transition]
18
+
19
+ [React 19][react-19] enhances the async/concurrent landscape by introducing [Actions][actions] and support for using async functions in Transitions. With the support for async Transitions, a new [`React.useOptimistic`][use-optimistic-blog] [hook][use-optimistic] was also introduced that allows you to surface state updates during a Transition to show users instant feedback.
20
+
21
+ ## Transitions in React Router
22
+
23
+ The introduction of Transitions in React makes the story of how React Router manages your navigations and router state a bit more complicated. These are powerful APIs but they don't come without some nuance and added complexity. We aim to make React Router work seamlessly with the new React features, but in some cases there may exist some tension between the new React ways to do things and some patterns you are already using in your React Router apps (i.e., pending states, optimistic UI).
24
+
25
+ To ensure a smooth adoption story, we've introduced changes related to Transitions behind an opt-in `useTransitions` flag so that you can upgrade in a non-breaking fashion.
26
+
27
+ ### Current Behavior
28
+
29
+ We first leveraged `React.startTransition` to make React Router more Suspense-friendly in React Router [6.13.0][rr-6-13-0] via the `future.v7_startTransition` flag. In v7, that became the default behavior and all router state updates are currently wrapped in `React.startTransition`.
30
+
31
+ This default behavior has 2 potential issues that `useTransitions` is designed to solve:
32
+
33
+ - There are some valid use cases where you _don't_ want your updates wrapped in `startTransition`
34
+ - One specific issue is that `React.useSyncExternalStore` updates can't be Transitions ([^1][uses-transition-issue], [^2][uses-transition-tweet]). `useSyncExternalStore` forces a sync update, which means fallbacks can be shown in update transitions that would otherwise avoid showing the fallback.
35
+ - React Router has a `flushSync` option on navigations to use [`React.flushSync`][flush-sync] for state updates instead, but that's not always a proper solution
36
+ - React 19 has added a new `startTransition(() => Promise))` API as well as a new `useOptimistic` hook to surface updates during Transitions
37
+ - Without some updates to React Router, `startTransition(() => navigate(path))` doesn't work as you might expect, because we are not using `useOptimistic` internally so router state updates don't surface during the navigation, which breaks hooks like `useNavigation`
38
+
39
+ To provide a solution to both of the above issues, we're introducing a new `useTransitions` prop to the router components that will let you opt-out of using `startTransition` for router state updates (solving the first issue), or opt-into a more enhanced usage of `startTransition` + `useOptimistic` (solving the second issue). Because the current behavior is a bit incomplete with the new React 19 APIs, we plan to make the opt-in behavior the default in React Router v8, but we will likely retain the opt-out flag for use cases such as `useSyncExternalStore`.
40
+
41
+ ### Opt-out via `useTransitions=false`
42
+
43
+ If your application is not "Transition-friendly" due to the usage of `useSyncExternalStore` (or other reasons), then you can opt-out via the prop:
44
+
45
+ ```tsx
46
+ // Framework Mode (entry.client.tsx)
47
+ <HydratedRouter useTransitions={false} />
48
+
49
+ // Data Mode
50
+ <RouterProvider useTransitions={false} />
51
+
52
+ // Declarative Mode
53
+ <BrowserRouter useTransitions={false} />
54
+ ```
55
+
56
+ This will stop the router from wrapping internal state updates in `startTransition`.
57
+
58
+ ### Opt-in via `useTransitions=true`
59
+
60
+ <docs-info>Opting into this feature in Framework or Data Mode requires that you are using React 19 because it needs access to [`React.useOptimistic`][use-optimistic]</docs-info>
61
+
62
+ If you want to make your application play nicely with all of the new React 19 features that rely on concurrent mode and Transitions, then you can opt-in via the new prop:
63
+
64
+ ```tsx
65
+ // Framework Mode (entry.client.tsx)
66
+ <HydratedRouter useTransitions />
67
+
68
+ // Data Mode
69
+ <RouterProvider useTransitions />
70
+
71
+ // Declarative Mode
72
+ <BrowserRouter useTransitions />
73
+ ```
74
+
75
+ With this flag enabled:
76
+
77
+ - All internal state updates are wrapped in `React.startTransition` (current behavior without the flag)
78
+ - All `<Link>`/`<Form>` navigations will be wrapped in `React.startTransition`, using the promise returned by `useNavigate`/`useSubmit` so that the Transition lasts for the duration of the navigation
79
+ - `useNavigate`/`useSubmit` do not automatically wrap in `React.startTransition`, so you can opt-out of a Transition-enabled navigation by using those directly
80
+ - In Framework/Data modes, a subset of the router state updates during a navigation will be surfaced to the UI via `useOptimistic`
81
+ - State related to the _ongoing_ navigation and all fetcher information will be surfaced:
82
+ - `state.navigation` for `useNavigation()`
83
+ - `state.revalidation` for `useRevalidator()`
84
+ - `state.actionData` for `useActionData()`
85
+ - `state.fetchers` for `useFetcher()` and `useFetchers()`
86
+ - State related to the _current_ location will not be surfaced:
87
+ - `state.location` for `useLocation`
88
+ - `state.matches` for `useMatches()`,
89
+ - `state.loaderData` for `useLoaderData()`
90
+ - `state.errors` for `useRouteError()`
91
+ - etc.
92
+
93
+ Enabling this flag means that you can now have fully-Transition-enabled navigations that play nicely with any other ongoing Transition-enabled aspects of your application.
94
+
95
+ The only APIs that are automatically wrapped in an async Transition are `<Link>` and `<Form>`. For everything else, you need to wrap the operation in `startTransition` yourself.
96
+
97
+ ```tsx
98
+ // Automatically Transition-enabled
99
+ <Link to="/path" />
100
+ <Form method="post" action="/path" />
101
+
102
+ // Manually Transition-enabled
103
+ startTransition(() => navigate("/path"));
104
+ startTransition(() => submit(data, { method: 'post', action: "/path" }));
105
+ startTransition(() => fetcher.load("/path"));
106
+ startTransition(() => fetcher.submit(data, { method: "post", action: "/path" }));
107
+
108
+ // Not Transition-enabled
109
+ navigate("/path");
110
+ submit(data, { method: 'post', action: "/path" });
111
+ fetcher.load("/path");
112
+ fetcher.submit(data, { method: "post", action: "/path" });
113
+ ```
114
+
115
+ **Important:** You must always `return` or `await` the `navigate` promise inside `startTransition` so that the Transition encompasses the full duration of the navigation. If you forget to `return` or `await` the promise, the Transition will end prematurely and things won't work as expected.
116
+
117
+ ```tsx
118
+ // ✅ Returned promise
119
+ startTransition(() => navigate("/path"));
120
+ startTransition(() => {
121
+ setOptimistic(something);
122
+ return navigate("/path"));
123
+ });
124
+
125
+ // ✅ Awaited promise
126
+ startTransition(async () => {
127
+ setOptimistic(something);
128
+ await navigate("/path"));
129
+ });
130
+
131
+ // ❌ Non-returned promise
132
+ startTransition(() => {
133
+ setOptimistic(something);
134
+ navigate("/path"));
135
+ });
136
+
137
+ // ❌ Non-Awaited promise
138
+ startTransition(async () => {
139
+ setOptimistic(something);
140
+ navigate("/path"));
141
+ });
142
+ ```
143
+
144
+ #### `popstate` navigations
145
+
146
+ There is currently a bug with optimistic states and `popstate`. If you need to read the current route during a back navigation, which cannot complete synchronously (e.g. Suspends on uncached data), you can set the optimistic state before navigating back or defer the optimistic update in a timer or microtask.
147
+
148
+ [react-18]: https://react.dev/blog/2022/03/29/react-v18
149
+ [concurrent]: https://react.dev/blog/2022/03/29/react-v18#what-is-concurrent-react
150
+ [transitions]: https://react.dev/blog/2022/03/29/react-v18#new-feature-transitions
151
+ [use-transition]: https://react.dev/reference/react/useTransition#reference
152
+ [start-transition]: https://react.dev/reference/react/startTransition
153
+ [react-19]: https://react.dev/blog/2024/12/05/react-19
154
+ [actions]: https://react.dev/blog/2024/12/05/react-19#actions
155
+ [use-optimistic-blog]: https://react.dev/blog/2024/12/05/react-19#new-hook-optimistic-updates
156
+ [use-optimistic]: https://react.dev/reference/react/useOptimistic
157
+ [flush-sync]: https://react.dev/reference/react-dom/flushSync
158
+ [rr-6-13-0]: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6130
159
+ [uses-transition-issue]: https://github.com/facebook/react/issues/26382
160
+ [uses-transition-tweet]: https://x.com/rickhanlonii/status/1683636856808775682
@@ -0,0 +1,7 @@
1
+ ---
2
+ title: Route Matching
3
+ hidden: true
4
+ # want to explain how the matching algorithm works with any potential gotchas
5
+ ---
6
+
7
+ # Route Matching
@@ -0,0 +1,4 @@
1
+ ---
2
+ title: Server vs. Client Code Execution
3
+ hidden: true
4
+ ---
@@ -0,0 +1,465 @@
1
+ ---
2
+ title: Sessions and Cookies
3
+ ---
4
+
5
+ # Sessions and Cookies
6
+
7
+ [MODES: framework, data]
8
+
9
+ ## Sessions
10
+
11
+ Sessions are an important part of websites that allow the server to identify requests coming from the same person, especially when it comes to server-side form validation or when JavaScript is not on the page. Sessions are a fundamental building block of many sites that let users "log in", including social, e-commerce, business, and educational websites.
12
+
13
+ When using React Router as your framework, sessions are managed on a per-route basis (rather than something like express middleware) in your `loader` and `action` methods using a "session storage" object (that implements the [`SessionStorage`][session-storage] interface). Session storage understands how to parse and generate cookies, and how to store session data in a database or filesystem.
14
+
15
+ ### Using Sessions
16
+
17
+ This is an example of a cookie session storage:
18
+
19
+ ```ts filename=app/sessions.server.ts
20
+ import { createCookieSessionStorage } from "react-router";
21
+
22
+ type SessionData = {
23
+ userId: string;
24
+ };
25
+
26
+ type SessionFlashData = {
27
+ error: string;
28
+ };
29
+
30
+ const { getSession, commitSession, destroySession } =
31
+ createCookieSessionStorage<SessionData, SessionFlashData>(
32
+ {
33
+ // a Cookie from `createCookie` or the CookieOptions to create one
34
+ cookie: {
35
+ name: "__session",
36
+
37
+ // all of these are optional
38
+ domain: "reactrouter.com",
39
+ // Expires can also be set (although maxAge overrides it when used in combination).
40
+ // Note that this method is NOT recommended as `new Date` creates only one date on each server deployment, not a dynamic date in the future!
41
+ //
42
+ // expires: new Date(Date.now() + 60_000),
43
+ httpOnly: true,
44
+ maxAge: 60,
45
+ path: "/",
46
+ sameSite: "lax",
47
+ secrets: ["s3cret1"],
48
+ secure: true,
49
+ },
50
+ },
51
+ );
52
+
53
+ export { getSession, commitSession, destroySession };
54
+ ```
55
+
56
+ We recommend setting up your session storage object in `app/sessions.server.ts` so all routes that need to access session data can import from the same spot.
57
+
58
+ The input/output to a session storage object are HTTP cookies. `getSession()` retrieves the current session from the incoming request's `Cookie` header, and `commitSession()`/`destroySession()` provide the `Set-Cookie` header for the outgoing response.
59
+
60
+ You'll use methods to get access to sessions in your `loader` and `action` functions.
61
+
62
+ After retrieving a session with `getSession`, the returned session object has a handful of methods and properties:
63
+
64
+ ```tsx
65
+ export async function action({
66
+ request,
67
+ }: ActionFunctionArgs) {
68
+ const session = await getSession(
69
+ request.headers.get("Cookie"),
70
+ );
71
+ session.get("foo");
72
+ session.has("bar");
73
+ // etc.
74
+ }
75
+ ```
76
+
77
+ See the [Session API][session-api] for all methods available on the session object.
78
+
79
+ ### Login form example
80
+
81
+ A login form might look something like this:
82
+
83
+ ```tsx filename=app/routes/login.tsx lines=[4-7,12-14,16,22,25,33-35,46,51,56,61]
84
+ import { data, redirect } from "react-router";
85
+ import type { Route } from "./+types/login";
86
+
87
+ import {
88
+ getSession,
89
+ commitSession,
90
+ } from "../sessions.server";
91
+
92
+ export async function loader({
93
+ request,
94
+ }: Route.LoaderArgs) {
95
+ const session = await getSession(
96
+ request.headers.get("Cookie"),
97
+ );
98
+
99
+ if (session.has("userId")) {
100
+ // Redirect to the home page if they are already signed in.
101
+ return redirect("/");
102
+ }
103
+
104
+ return data(
105
+ { error: session.get("error") },
106
+ {
107
+ headers: {
108
+ "Set-Cookie": await commitSession(session),
109
+ },
110
+ },
111
+ );
112
+ }
113
+
114
+ export async function action({
115
+ request,
116
+ }: Route.ActionArgs) {
117
+ const session = await getSession(
118
+ request.headers.get("Cookie"),
119
+ );
120
+ const form = await request.formData();
121
+ const username = form.get("username");
122
+ const password = form.get("password");
123
+
124
+ const userId = await validateCredentials(
125
+ username,
126
+ password,
127
+ );
128
+
129
+ if (userId == null) {
130
+ session.flash("error", "Invalid username/password");
131
+
132
+ // Redirect back to the login page with errors.
133
+ return redirect("/login", {
134
+ headers: {
135
+ "Set-Cookie": await commitSession(session),
136
+ },
137
+ });
138
+ }
139
+
140
+ session.set("userId", userId);
141
+
142
+ // Login succeeded, send them to the home page.
143
+ return redirect("/", {
144
+ headers: {
145
+ "Set-Cookie": await commitSession(session),
146
+ },
147
+ });
148
+ }
149
+
150
+ export default function Login({
151
+ loaderData,
152
+ }: Route.ComponentProps) {
153
+ const { error } = loaderData;
154
+
155
+ return (
156
+ <div>
157
+ {error ? <div className="error">{error}</div> : null}
158
+ <form method="POST">
159
+ <div>
160
+ <p>Please sign in</p>
161
+ </div>
162
+ <label>
163
+ Username: <input type="text" name="username" />
164
+ </label>
165
+ <label>
166
+ Password:{" "}
167
+ <input type="password" name="password" />
168
+ </label>
169
+ </form>
170
+ </div>
171
+ );
172
+ }
173
+ ```
174
+
175
+ And then a logout form might look something like this:
176
+
177
+ ```tsx filename=app/routes/logout.tsx
178
+ import {
179
+ getSession,
180
+ destroySession,
181
+ } from "../sessions.server";
182
+ import type { Route } from "./+types/logout";
183
+
184
+ export async function action({
185
+ request,
186
+ }: Route.ActionArgs) {
187
+ const session = await getSession(
188
+ request.headers.get("Cookie"),
189
+ );
190
+ return redirect("/login", {
191
+ headers: {
192
+ "Set-Cookie": await destroySession(session),
193
+ },
194
+ });
195
+ }
196
+
197
+ export default function LogoutRoute() {
198
+ return (
199
+ <>
200
+ <p>Are you sure you want to log out?</p>
201
+ <Form method="post">
202
+ <button>Logout</button>
203
+ </Form>
204
+ <Link to="/">Never mind</Link>
205
+ </>
206
+ );
207
+ }
208
+ ```
209
+
210
+ <docs-warning>It's important that you logout (or perform any mutation for that matter) in an `action` and not a `loader`. Otherwise you open your users to [Cross-Site Request Forgery][csrf] attacks.</docs-warning>
211
+
212
+ ### Session Gotchas
213
+
214
+ Because of nested routes, multiple loaders can be called to construct a single page. When using `session.flash()` or `session.unset()`, you need to be sure no other loaders in the request are going to want to read that, otherwise you'll get race conditions. Typically if you're using flash, you'll want to have a single loader read it, if another loader wants a flash message, use a different key for that loader.
215
+
216
+ ### Creating custom session storage
217
+
218
+ React Router makes it easy to store sessions in your own database if needed. The [`createSessionStorage()`][create-session-storage] API requires a `cookie` (for options for creating a cookie, see [cookies][cookies]) and a set of create, read, update, and delete (CRUD) methods for managing the session data. The cookie is used to persist the session ID.
219
+
220
+ - `createData` will be called from `commitSession` on the initial session creation when no session ID exists in the cookie
221
+ - `readData` will be called from `getSession` when a session ID exists in the cookie
222
+ - `updateData` will be called from `commitSession` when a session ID already exists in the cookie
223
+ - `deleteData` is called from `destroySession`
224
+
225
+ The following example shows how you could do this using a generic database client:
226
+
227
+ ```ts
228
+ import { createSessionStorage } from "react-router";
229
+
230
+ function createDatabaseSessionStorage({
231
+ cookie,
232
+ host,
233
+ port,
234
+ }) {
235
+ // Configure your database client...
236
+ const db = createDatabaseClient(host, port);
237
+
238
+ return createSessionStorage({
239
+ cookie,
240
+ async createData(data, expires) {
241
+ // `expires` is a Date after which the data should be considered
242
+ // invalid. You could use it to invalidate the data somehow or
243
+ // automatically purge this record from your database.
244
+ const id = await db.insert(data);
245
+ return id;
246
+ },
247
+ async readData(id) {
248
+ return (await db.select(id)) || null;
249
+ },
250
+ async updateData(id, data, expires) {
251
+ await db.update(id, data);
252
+ },
253
+ async deleteData(id) {
254
+ await db.delete(id);
255
+ },
256
+ });
257
+ }
258
+ ```
259
+
260
+ And then you can use it like this:
261
+
262
+ ```ts
263
+ const { getSession, commitSession, destroySession } =
264
+ createDatabaseSessionStorage({
265
+ host: "localhost",
266
+ port: 1234,
267
+ cookie: {
268
+ name: "__session",
269
+ sameSite: "lax",
270
+ },
271
+ });
272
+ ```
273
+
274
+ The `expires` argument to `createData` and `updateData` is the same `Date` at which the cookie itself expires and is no longer valid. You can use this information to automatically purge the session record from your database to save on space, or to ensure that you do not otherwise return any data for old, expired cookies.
275
+
276
+ ### Additional session utils
277
+
278
+ There are also several other session utilities available if you need them:
279
+
280
+ - [`isSession`][is-session]
281
+ - [`createMemorySessionStorage`][create-memory-session-storage]
282
+ - [`createSession`][create-session] (custom storage)
283
+ - [`createFileSessionStorage`][create-file-session-storage] (node)
284
+ - [`createWorkersKVSessionStorage`][create-workers-kv-session-storage] (Cloudflare Workers)
285
+ - [`createArcTableSessionStorage`][create-arc-table-session-storage] (architect, Amazon DynamoDB)
286
+
287
+ ## Cookies
288
+
289
+ A [cookie][cookie] is a small piece of information that your server sends someone in a HTTP response that their browser will send back on subsequent requests. This technique is a fundamental building block of many interactive websites that adds state so you can build authentication (see [sessions][sessions]), shopping carts, user preferences, and many other features that require remembering who is "logged in".
290
+
291
+ React Router's [`Cookie` interface][cookie-api] provides a logical, reusable container for cookie metadata.
292
+
293
+ ### Using cookies
294
+
295
+ While you may create these cookies manually, it is more common to use a [session storage][sessions].
296
+
297
+ In React Router, you will typically work with cookies in your `loader` and/or `action` functions, since those are the places where you need to read and write data.
298
+
299
+ Let's say you have a banner on your e-commerce site that prompts users to check out the items you currently have on sale. The banner spans the top of your homepage, and includes a button on the side that allows the user to dismiss the banner so they don't see it for at least another week.
300
+
301
+ First, create a cookie:
302
+
303
+ ```ts filename=app/cookies.server.ts
304
+ import { createCookie } from "react-router";
305
+
306
+ export const userPrefs = createCookie("user-prefs", {
307
+ maxAge: 604_800, // one week
308
+ });
309
+ ```
310
+
311
+ Then, you can `import` the cookie and use it in your `loader` and/or `action`. The `loader` in this case just checks the value of the user preference so you can use it in your component for deciding whether to render the banner. When the button is clicked, the `<form>` calls the `action` on the server and reloads the page without the banner.
312
+
313
+ ### User preferences example
314
+
315
+ ```tsx filename=app/routes/home.tsx lines=[4,9-11,18-20,29]
316
+ import { Link, Form, redirect } from "react-router";
317
+ import type { Route } from "./+types/home";
318
+
319
+ import { userPrefs } from "../cookies.server";
320
+
321
+ export async function loader({
322
+ request,
323
+ }: Route.LoaderArgs) {
324
+ const cookieHeader = request.headers.get("Cookie");
325
+ const cookie =
326
+ (await userPrefs.parse(cookieHeader)) || {};
327
+ return { showBanner: cookie.showBanner };
328
+ }
329
+
330
+ export async function action({
331
+ request,
332
+ }: Route.ActionArgs) {
333
+ const cookieHeader = request.headers.get("Cookie");
334
+ const cookie =
335
+ (await userPrefs.parse(cookieHeader)) || {};
336
+ const bodyParams = await request.formData();
337
+
338
+ if (bodyParams.get("bannerVisibility") === "hidden") {
339
+ cookie.showBanner = false;
340
+ }
341
+
342
+ return redirect("/", {
343
+ headers: {
344
+ "Set-Cookie": await userPrefs.serialize(cookie),
345
+ },
346
+ });
347
+ }
348
+
349
+ export default function Home({
350
+ loaderData,
351
+ }: Route.ComponentProps) {
352
+ return (
353
+ <div>
354
+ {loaderData.showBanner ? (
355
+ <div>
356
+ <Link to="/sale">Don't miss our sale!</Link>
357
+ <Form method="post">
358
+ <input
359
+ type="hidden"
360
+ name="bannerVisibility"
361
+ value="hidden"
362
+ />
363
+ <button type="submit">Hide</button>
364
+ </Form>
365
+ </div>
366
+ ) : null}
367
+ <h1>Welcome!</h1>
368
+ </div>
369
+ );
370
+ }
371
+ ```
372
+
373
+ ### Cookie attributes
374
+
375
+ Cookies have [several attributes][cookie-attrs] that control when they expire, how they are accessed, and where they are sent. Any of these attributes may be specified either in `createCookie(name, options)`, or during `serialize()` when the `Set-Cookie` header is generated.
376
+
377
+ ```ts
378
+ const cookie = createCookie("user-prefs", {
379
+ // These are defaults for this cookie.
380
+ path: "/",
381
+ sameSite: "lax",
382
+ httpOnly: true,
383
+ secure: true,
384
+ expires: new Date(Date.now() + 60_000),
385
+ maxAge: 60,
386
+ });
387
+
388
+ // You can either use the defaults:
389
+ cookie.serialize(userPrefs);
390
+
391
+ // Or override individual ones as needed:
392
+ cookie.serialize(userPrefs, { sameSite: "strict" });
393
+ ```
394
+
395
+ Please read [more info about these attributes][cookie-attrs] to get a better understanding of what they do.
396
+
397
+ ### Signing cookies
398
+
399
+ It is possible to sign a cookie to automatically verify its contents when it is received. Since it's relatively easy to spoof HTTP headers, this is a good idea for any information that you do not want someone to be able to fake, like authentication information (see [sessions][sessions]).
400
+
401
+ To sign a cookie, provide one or more `secrets` when you first create the cookie:
402
+
403
+ ```ts
404
+ const cookie = createCookie("user-prefs", {
405
+ secrets: ["s3cret1"],
406
+ });
407
+ ```
408
+
409
+ Cookies that have one or more `secrets` will be stored and verified in a way that ensures the cookie's integrity.
410
+
411
+ Secrets may be rotated by adding new secrets to the front of the `secrets` array. Cookies that have been signed with old secrets will still be decoded successfully in `cookie.parse()`, and the newest secret (the first one in the array) will always be used to sign outgoing cookies created in `cookie.serialize()`.
412
+
413
+ ```ts filename=app/cookies.server.ts
414
+ export const cookie = createCookie("user-prefs", {
415
+ secrets: ["n3wsecr3t", "olds3cret"],
416
+ });
417
+ ```
418
+
419
+ ```tsx filename=app/routes/my-route.tsx
420
+ import { data } from "react-router";
421
+ import { cookie } from "../cookies.server";
422
+ import type { Route } from "./+types/my-route";
423
+
424
+ export async function loader({
425
+ request,
426
+ }: Route.LoaderArgs) {
427
+ const oldCookie = request.headers.get("Cookie");
428
+ // oldCookie may have been signed with "olds3cret", but still parses ok
429
+ const value = await cookie.parse(oldCookie);
430
+
431
+ return data("...", {
432
+ headers: {
433
+ // Set-Cookie is signed with "n3wsecr3t"
434
+ "Set-Cookie": await cookie.serialize(value),
435
+ },
436
+ });
437
+ }
438
+ ```
439
+
440
+ ### Additional cookie utils
441
+
442
+ There are also several other cookie utilities available if you need them:
443
+
444
+ - [`isCookie`][is-cookie]
445
+ - [`createCookie`][create-cookie]
446
+
447
+ To learn more about each attribute, please see the [MDN Set-Cookie docs][cookie-attrs].
448
+
449
+ [csrf]: https://developer.mozilla.org/en-US/docs/Glossary/CSRF
450
+ [cookies]: #cookies
451
+ [sessions]: #sessions
452
+ [session-storage]: https://api.reactrouter.com/v7/interfaces/react-router.SessionStorage
453
+ [session-api]: https://api.reactrouter.com/v7/interfaces/react-router.Session
454
+ [is-session]: https://api.reactrouter.com/v7/functions/react-router.isSession
455
+ [cookie-api]: https://api.reactrouter.com/v7/interfaces/react-router.Cookie
456
+ [create-session-storage]: https://api.reactrouter.com/v7/functions/react-router.createSessionStorage
457
+ [create-session]: https://api.reactrouter.com/v7/functions/react-router.createSession
458
+ [create-memory-session-storage]: https://api.reactrouter.com/v7/functions/react-router.createMemorySessionStorage
459
+ [create-file-session-storage]: https://api.reactrouter.com/v7/functions/_react-router_node.createFileSessionStorage
460
+ [create-workers-kv-session-storage]: https://api.reactrouter.com/v7/functions/_react-router_cloudflare.createWorkersKVSessionStorage
461
+ [create-arc-table-session-storage]: https://api.reactrouter.com/v7/functions/_react-router_architect.createArcTableSessionStorage
462
+ [cookie]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
463
+ [cookie-attrs]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes
464
+ [is-cookie]: https://api.reactrouter.com/v7/functions/react-router.isCookie
465
+ [create-cookie]: https://api.reactrouter.com/v7/functions/react-router.createCookie
@@ -0,0 +1,16 @@
1
+ ---
2
+ title: Special Files
3
+ hidden: true
4
+ ---
5
+
6
+ # Special Files
7
+
8
+ The content of this page has been moved to the following:
9
+
10
+ - [`react-router.config.ts`](../api/framework-conventions/react-router.config.ts) - Optional configuration file for your app
11
+ - [`root.tsx`](../api/framework-conventions/root.tsx) - Required root route that renders the HTML document
12
+ - [`routes.ts`](../api/framework-conventions/routes.ts) - Required route configuration mapping URLs to components
13
+ - [`entry.client.tsx`](../api/framework-conventions/entry.client.tsx) - Optional client-side entry point for hydration
14
+ - [`entry.server.tsx`](../api/framework-conventions/entry.server.tsx) - Optional server-side entry point for rendering
15
+ - [`.server` modules](../api/framework-conventions/server-modules) - Server-only modules excluded from client bundles
16
+ - [`.client` modules](../api/framework-conventions/client-modules) - Client-only modules excluded from server bundles