JWT (JSON Web Tokens) are stateless tokens stored client-side. The server signs a payload with a secret, the client sends it in Authorization header. No server-side session storage needed.
Session-based auth stores session data server-side (in memory, Redis, or database). A session ID cookie identifies the client. Better for server control but requires sticky sessions or shared storage.
OAuth 2.0 delegates authentication to providers (Google, GitHub). The Authorization Code flow is most secure for server apps. Use libraries like passport.js for integration.
Password hashing: always use bcrypt or argon2 with salt rounds (12+). Never store plain passwords. Implement refresh tokens for long-lived access without security risks.
Rate limiting prevents brute-force attacks. CORS configuration restricts origins. Helmet.js adds security headers. Input validation prevents injection attacks.