Hi,
I am working with a Next.js frontend where access and refresh tokens are stored in secure, HTTP-only cookies on the server side.
My application consists of three services: an auth server, a frontend, and a backend.
Currently, only the frontend checks for authentication.
However, I want the backend to also verify whether a user is authenticated when it receives a request from the frontend.

Here’s the problem I am trying to solve:
Initial page data is loaded via server components (on the server).
Client-side interactions (e.g. for CRUD operations) also fetch fresh data.
I want both types of requests server-side and client-side to automatically include the session cookie, so that the backend can validate the session for each request. Tried it inside the middleware already

What I am looking for is:

A best-practice approach to session management in Next.js for this architecture.

What’s the recommended way to implement this?