Authentication Across the Join

Decide where the credential lives, and know the trade. A cookie set by the server, marked HttpOnly and Secure, cannot be read by JavaScript and so survives a cross-site scripting bug. A token in localStorage is readable by any script that runs on your page, which means an XSS becomes an account takeover.

Neither is wrong in every case. Pick deliberately, and write down why.

The flows people forget. Signing in is the easy one.

What happens when the session expires while somebody is typing? Where do they land after signing in from a deep link? Does signing out clear everything, including anything cached in memory? Does a second tab notice? What does the interface do between the page loading and knowing whether anyone is signed in, which is a real state and usually renders as a flash of the wrong thing.