User Authentication with FastAPI and Next.js

This post covers a complete user authentication implementation using FastAPI for the backend and Next.js for the frontend. The system uses JWT tokens, bcrypt password hashing, and HTTP-only cookie management for secure session handling. I'll walk through the key components and explain the technical decisions behind each part. Architecture Overview The authentication system follows Domain-Driven Design (DDD) principles with clear separation between domain logic, application services, and infrastructure concerns: Backend: FastAPI with PostgreSQL Frontend: Next.js with React Query and Zustand Security: JWT tokens with access/refresh token rotation Session Management: Secure HTTP-only cookies Backend Implementation Domain Layer: User Entity and Value Objects The User entity serves as the core domain object, encapsulating user data and behavior: # backend/src/aichat/domains/user/domain/entities/user.py class User(Entity): def __init__( self, *, id: UUID, created_at: dt.datetime, updated_at: