Discussion on: React 18 server components deep dive

[Jacopo Marrone]

Before reading this post, that shows this implementation :

// hello.client.js
"use client"

import {useState} from 'react';
import Message from './Message.server';

function Hello_Client() {
  const [selectedId, setSelectedId] = useState(1);
  return (
    <div>
      <button onClick={() => setSelectedId(selectedId + 1)}>
        Next
      </button>
      <Message id={selectedId} />
    </div>
  );
}

// message.server.js

import {db} from './db.server';

function Message({id}) {
  const message = db.messages.get(id);
  return (
    <div>
      <h1>{message.title}</h1>
      <p>{message.body}</p>
    </div>
  );
}

my idea to do the same is to implement with cookies as communication between server and client tree.
Like so:

// root.server.js
import Message from './Message.server';
import Hello_Client from './hello.client';

function Root_Server() {
  const selectedMessageID = getFromCookie('message-id');
  return (
    <Hello_Client>
      <Message={selectedMessageID} />
    </Hello_Client>
  );
}

// hello.client.js
"use client";

function Hello_Client(props) {
  const handleSelect = ( ) => {
    const currentMessageID = getFromCookie('message-id');
    setCookie('message-id', currentMessageID + 1);
    revalidateRoute('/'); // tell server tree to rerender with new data
  }

  return (
    <div>
      <button onClick={handleSelect}>
        Next
      </button>
      {children}
    </div>
  );
}

// message.server.js

import {db} from './db.server';

function Message({id}) {
  const message = db.messages.get(id);
  return (
    <div>
      <h1>{message.title}</h1>
      <p>{message.body}</p>
    </div>
  );
}

Are both ok ?
Is there a risk of exposing server stuff with first approach ?

Edited: added revalidateRoute() in click handler

[Ruslan Kh.]

Both approaches are possible, but they have different tradeoffs:

• React Server Components (RSC): This is the recommended approach. It allows the server and client to collaborate on rendering, improving performance and reducing the amount of JavaScript sent to the client.
• Use cookies: This is unconventional and generally not recommended due to potential performance issues, security risks (such as XSS and CSRF attacks), and added complexity.

As for exposing server stuff, RSCs are designed to be secure. They run only on the server and have no direct access to the client. Any data returned by a server component is included in the HTML response, much like any other data included in an HTTP response.

[Ruslan Kh.]

Modify the App.client.js file to use cookies:

// App.client.js

import {useState, useEffect} from 'react';
import Message from './Message.server';

function App() {
  const [selectedId, setSelectedId] = useState(() => {
    // Read the initial value from the cookie
    return Number(document.cookie.replace(/(?:(?:^|.*;\s*)selectedId\s*\=\s*([^;]*).*$)|^.*$/, "$1")) || 1;
  });

  useEffect(() => {
    // Update the cookie whenever selectedId changes
    document.cookie = `selectedId=${selectedId}`;
  }, [selectedId]);

  return (
    <div>
      <button onClick={() => setSelectedId(selectedId + 1)}>
        Next
      </button>
      <Message id={selectedId} />
    </div>
  );
}

export default App;

In this example, we'll use the useState and useEffect hooks to read the initial selectedId value from a cookie and update the cookie whenever the selectedId changes.

Note that this is a simplified example. In a real application, you would want to use a more robust method for managing cookies, such as the js-cookie library.

[Jacopo Marrone]

This is from Next.js docs:

"use client" sits between server-only and client code. It's placed at the top of a file, above imports, to define the cut-off point where it crosses the boundary from the server-only to the client part. Once "use client" is defined in a file, all other modules imported into it, including child components, are considered part of the client bundle.

Since Server Components are the default, all components are part of the Server Component module graph unless defined or imported in a module that starts with the "use client" directive.

Good to know:

"use client" does not need to be defined in every file. The Client module boundary only needs to be defined once, at the "entry point", for all modules imported into it to be considered a Client Component.

I was assuming that this behavior is a React thing and not a Next thing.
There are some place where this is explained from a plain React side?