title: How to safely deal with authentication on a web app rendered server-side?
body: <p>I thought of a few approaches myself:</p>
  
  <ul>
  <li><strong>Use cookies.</strong> This requires CSRF protection and some logic complications as one needs to unify the cookie for both API and main domain. Also cookies seem a bit creepy regarding security overall</li>
  <li><strong>Render auth-related stuff on client.</strong> Well this would work but things as simple as the navbar, which should hide SignIn/SignUp buttons when authed, is auth related. With some overview of my existing application, SSR entirely looks pointless at that point.</li>
  </ul>
  
  <p>What is the better approach to this? Something that's secure and practical?</p>
  
  <blockquote>
    <p><strong>Edit:</strong> I would highly appreciate a comment describing the reason for downvoting. I'm providing a bounty for a definitive answer that answers questions like <a href="https://stackoverflow.com/q/48009624/2164304">this</a> and <a href="https://stackoverflow.com/q/33358249/2164304">this</a> plus a lot of issues posted on GitHub and threads posted on different framework-specific forums.</p>
  </blockquote>