I really wish directus had a simple "cookie" based auth, and not all this crazyness with a cookie + refresh token + renewals + refresh + JWTs +... I was trying to use it with Next.js, where I needed to authenticate the current user server side to fetch some data and it was by far the most overcomplicated part of my application.

We ended up switching to Django, where just an traditional http only secure cookie which we "proxied" from Next.js to the frontend and back was enough and maybe even more secure than all the mangling we had to do with the refresh tokens, etc.

I really wish this trend of fancy authentication mechanisms goes away. It doesn't take in account how easy they make for people to mess up on their implementation/usage of it when things are too complex.