remix-v2-meta-sessions-review

Remix v2 Meta, Sessions, Auth, and CSRF Code Review

Reviews Remix v2 meta/SEO, session, auth-gate, and CSRF code paths. Loaded by the umbrella review-remix-v2 reviewer when a diff touches any of: meta/links exports, root.tsx, *.server.ts session/cookie modules, loaders/actions reading or writing session, or <Form>/useFetcher mutations.

See remix-v2-meta-sessions for canonical patterns.

Quick Reference

Highest-stakes detection — call out first: v1 meta object shape (return { title, description }) in a v2 codebase. It typechecks, but the runtime ignores it and the page renders with no title and no meta tags. Grep every export const meta and confirm the return value starts with [, not {.

Review Checklist

• meta returns MetaDescriptor[] (array starts with [), NOT the v1 object shape
• OG / Twitter tags use { property, content }, NOT v1 shorthand { "og:title": "..." }
• No document.title = "..." or useEffect(() => { document.title = ... }) — meta is set via the meta export
• root.tsx includes <Meta /> and <Links /> inside <head>
• Child meta that wants parent values uses matches.flatMap((m) => m.meta ?? [])
• meta null-guards data (loader may not have run / returned undefined on 404)
• Cookie config sets httpOnly: true and secure: process.env.NODE_ENV === "production"
• secrets is read from process.env (no hardcoded strings, no committed .env.example values)
• secrets is an array supporting rotation (prepend new, keep old) — not a single value
• Every session.set/session.unset/session.flash is followed by a response with "Set-Cookie": await commitSession(session)
• Auth gate is in loader (or action) via requireUserId(request) — NOT a component-level redirect
• Logout is an action (POST), not a loader (GET)
• Mutating actions call csrf.validate(request) when CSRF protection is in use
• CSRF token uses a dedicated createCookie("csrf", ...), NOT the session cookie
• Mutations use <Form> / useFetcher so AuthenticityTokenInput attaches the token (no manual fetch POST)