Floci sample app
Next.js (this app) calls the Go API server-side. Pages under /mypage and /api/me require login.
Next.js
Server Components and Server Actions behind CloudFront and AWS WAF.
Go API
Reachable only from inside the VPC, through the internal ALB.
Cognito
Sign-up with email verification, sessions in HttpOnly cookies.