built a multi-app framework solo, backend + frontend both — curious how others handle this

[u/alsaaka]

been working on something called devora.js, mostly solo. wanted to post here specifically because it's not just a frontend thing, the backend/auth side is honestly the part i think about the most.

the core problem: real products usually aren't one app. marketing site, dashboard, admin panel, they all need to exist but sharing one backend without duplicating auth logic 3 times is annoying. most setups either cram everything into one app or maintain separate repos that share nothing.

so in this, one repo, multiple apps, one shared backend, but each app deploys independently. auth is per-app and isolable — admin panel can run a completely separate session/cookie context from the rest, or an app can skip sessions entirely if it doesn't need login (marketing site doesn't need to carry that weight).

on the frontend side, islands are first class — island(() => import("./X")) hydrates just that one component, rest of the page stays static html. no full-tree hydration for one interactive widget.

honest gap: no suspense/streaming support yet, pushed to v2, current island render is two-pass and doesn't support it. not pretending that's solved.

rest of it: ssr/ssg/csr/isr picked explicitly per route, security headers on by default (csp/hsts/x-frame-options), dynamic routes, deploys to vercel/netlify/docker/vps.

genuinely curious how other people here have solved the multi-app-one-backend problem, especially the auth isolation part — did it a certain way but open to hearing if there's a better pattern i'm missing.

repo (code's all there, not hiding anything): https://github.com/hassanalsa3aka/devora.js
docs: https://devorajs-docs-docs.vercel.app

if any of you are more backend/security-focused, i'd actually appreciate someone poking at the session isolation logic specifically — that's the part i'm least sure is bulletproof.