I agree that most of the authentication belongs on the backend, but there's still the question of how best to handle/recognize authenticated users and authorized requests on the frontend. Should I be using JSON web tokens, or cookies? What's the best way to protect routes for users with varying degrees of access? If anything, I'd like to see pros and cons of each strategy, assuming a backend implementation is already in place.

> your front-end will fall into line.

How, exactly? Basic auth? Cookies? Tokens? OAuth?

There are lots of ways to do this, and I agree with your parent that if there is a best practice, it isn't obvious or well-known.

Edit: Ignore this - posted at the same time as arms!

This is what we've been doing at my workplace, we're a Google partner so all Auth is done through Google.