Architecture question

Question

I m using Next js frontend and SSR + FastAPI as a traditional backend The FastAPI backend is the same application logically same domain and can be called from the browser directly Do you recommend using a JWT session for this architecture and sending the JWT to FastAPI

rp · Answer

Hey < petrgazarov> I wouldn t recommend enabling the JWT feature here Just use the session cookies and use our backend SDK to verify the sessions in fastapi

petrgazarov · Answer

I see makes sense I m also considering having multiple domains Like so app my domain com client application api my domain com api In this case I can t set a cookie for api because it s not the same domain Is there a way to make a non JWT approach work in this case

channels · Answer

hey i apologise if i am wrong but i think looking into cors will clear this up

rp · Answer

Also there is a setting called cookieDomain in the backend s session init which allows you to share cookies across sub domains

rp · Answer

Setting the value to my domain com would allow sharing across all the sub domains of that site

petrgazarov · Answer

Cool thanks

petrgazarov · Answer

I haven t tried it in production on different domains yet but so far it works nicely on localhost I use Next js for session verification only all other supertokens backend routes are in FastAPI

petrgazarov · Answer

Love that supertokens is very flexible It definitely has a learning curve but the more I use it the more I like it

rp · Answer

great let us know if you run into issues