Supporting login state across SSR and CSR is not merely a question of whether a cookie travels with the request. The real work is verifying identity on the server, reusing that result for the first client render, recovering a good browser experience later, and still authorizing every protected operation on the server.
Start with three minimal implementations
Before discussing abstractions, here are representative ways that Next.js, Nuxt, and Cabloy carry server-verified login state into the first client render.
All three examples deliberately expose only a UI-safe public DTO. A raw session token, refresh token, password hash, and server-internal fields do not belong in a hydration payload.
Next.js App Router: a Server Component passes a safe DTO explicitly
