Building Resilient Full-Stack Systems: Next.js 15 App Router with Spring Boot Microservices

## The Polyglot Full-Stack Topology

Modern full-stack engineering often leverages the strengths of multiple ecosystems: - **Next.js 15 (React 19)** on the presentation layer for lightning-fast server-side rendering, edge caching, and optimized user interfaces. - **Java & Spring Boot** on the backend for robust business logic, high-throughput multithreading, enterprise security, and transactional integrity.

## Server-Side Fetching with React Server Components (RSC)

Next.js 15 App Router defaults all components to React Server Components. This architecture enables backend API calls to occur server-to-server within the internal network:

// Server Component: direct server-to-server call to internal API Gateway
export default async function PortfolioOverview({ userId }: { userId: string }) {
  const response = await fetch(`http://api-gateway:8080/api/v1/portfolios/${userId}`, {
    headers: {
      'X-Internal-Secret': process.env.INTERNAL_SERVICE_SECRET || '',
    },
    next: { revalidate: 60 }, // Cache on edge for 60 seconds
  });

  if (!response.ok) throw new Error('Failed to fetch portfolio data');
  const portfolio: PortfolioDto = await response.json();

  return (
    <div className="grid grid-cols-1 md:grid-cols-3 gap-6">
      <StatCard title="Portfolio Value" value={portfolio.totalValue} />
      <StatCard title="Unrealized P&L" value={portfolio.unrealizedPnl} />
      <StatCard title="Available Cash" value={portfolio.cashBalance} />
    </div>
  );
}

## Handling Secure Cross-Origin Authentication

When the Next.js frontend and Spring Boot API Gateway operate on separate subdomains (e.g. `app.example.com` and `api.example.com`), cookie configuration is paramount:

1. **HttpOnly**: Prevents JavaScript access and protects against XSS token theft. 2. **Secure**: Ensures tokens are only transmitted over TLS/HTTPS. 3. **SameSite=Lax or None**: `SameSite=Lax` works seamlessly when sharing a common parent domain, while `SameSite=None; Secure` is required for cross-domain calls. 4. **Spring Cloud Gateway Cookie Forwarding**: Ensure the gateway forwards authorization cookies across downstream microservice invocations.

## Unified Type Safety Across Java and TypeScript

Maintaining consistency between Java backend DTOs and TypeScript frontend models prevents runtime mapping errors. Defining shared contracts with strict TypeScript interfaces mirroring Spring Boot records/classes guarantees end-to-end reliability.

## Summary

Combining the agility and SEO strengths of Next.js 15 with the robustness of Spring Boot creates an enterprise-ready architecture capable of scaling to millions of requests with optimal user experience and minimal maintenance friction.