I'm trying to understand how authentication might change considering a SSR approach Vs a SPA approach.

In my SPA experience there would be a cookie/jwt that would be included and sent to the backend API which will reject requests that don't authenticate or do the work on the db and give the result in the response.

In a SSR architecture instead, what would be the approach. I'm wondering if the best option is to take the cookie/jwt from the client request to the front end server and then authenticate it there. This would still talk to the same backend API but these requests would all be authenticated based on some API key between the front end and backend. Then once the request from the client had been authenticated then a request can be made from the server to the backend API server for the actual work.

The only other option I can think of, which to be seems a bit less elegant, would be to forward the cookie/jwt from the client->fe onwards from fe>API server every request.

Is my understanding of this architecture and potential authentication patterns correct? Is there some other way I haven't thought of that you prefer?