Use separate collection to store auth user sessions to improve the peformance of the database

[MurzNN]

For now, Payload stores the user sessions directly in the User document - it looks convenient, but not good for performance at all!

The list of users is pretty much static; it changes only when a new user is created, or the existing user changes the password or other profile details.

But "sessions" is a pretty dynamic thing, they can be created very often, even several ones per second.

And using the user document as the session storage leads to a lot of write operations on the Users collection, which is very bad for performance. It also triggers all the hooks on the Users collection, spending the server resources on nothing.

Also, we can have potential race condition issues if the user tries to login from different browsers at the same time.

From the database performance perspective, it's much more performant to manage the session data in a separate collection 'sessions' with just 5 plain fields: sessionId, collectionSlug, documentId, createdAt, expiredAt; instead of each time overwriting the user document, which can contain a lot of fields and a long list of sessions too.

What do you think about this idea?

[sayem314]

Yes also then it would be easier to implement this feature #5360

[MurzNN]

Also, having a separate sessions collection, we can put it in a more performant storage like Redis.

And one more benefit: each new user's session will not invalidate the user's document cache and all other caches that depend on it.

[MurzNN]

Seems we can use the brand new, recently introduced "KV" key-value storage to store user sessions outside of the User document, looks like it fits pretty well for this case!

[MurzNN]

As we are releasing a new version v4 of Payload, I think now this is a only good chance to move this forward by introducing such change! Cuz if not now, seems we will have to wait years for v5 to make this breaking change!

[MurzNN]

Also, caught a fresh bug related to the session storage approach: #17295

It indicates that using the full document to store just sessions as a subfield array is not a good idea at all.