User Authentication with FastAPI and Next.js

This post covers a complete user authentication implementation using FastAPI for the backend and Next.js for the frontend. The system uses JWT tokens, bcrypt password hashing, and HTTP-only cookie management for secure session handling. I'll walk through the key components and explain the technical decisions behind each part. Architecture Overview The authentication system follows Domain-Driven Design (DDD) principles with clear separation between domain logic, application services, and infrastructure concerns: Backend : FastAPI with PostgreSQL Frontend : Next.js with React Query and Zustand Security : JWT tokens with access/refresh token rotation Session Management : Secure HTTP-only cookies Backend Implementation Domain Layer: User Entity and Value Objects The User entity serves as the core domain object, encapsulating user data and behavior: # backend/src/aichat/domains/user/domain/entities/user.py class User ( Entity ): def __init__ ( self , * , id : UUID , created_at : dt . dateti