Common Authentication Approaches
| Approach | How It Works |
|---|---|
| Session-based | Server stores session state, client holds a session ID cookie |
| Token-based (JWT) | Server issues a signed token the client sends with every request |
| OAuth / Social login | Delegating identity verification to Google, GitHub, etc. |
A Typical Login Flow
A user submits credentials, the server verifies them against the database (comparing a hashed password, covered next), and on success issues something the client can use to prove its identity on future requests — a session cookie or a token.
A Basic Login Route
Console Output
Click “Run” to see the console output here.
Never Reveal Which Part of the Login Failed
Return the same generic error ("Invalid credentials") whether the email doesn't exist or the password is wrong — telling an attacker "no such user" vs "wrong password" separately makes it trivial to enumerate valid accounts.
Best Practice
Rarely build authentication entirely from scratch for a real production app — established libraries (Passport.js) or hosted services (Auth0, Clerk) handle a huge amount of nuanced security detail that's easy to get subtly wrong on your own.