Authentication is one of those domains where the advice 'don't roll your own' is simultaneously correct and incomplete. You should use established libraries. But you also need to understand what they're doing — because misconfiguring an auth library is just as dangerous as writing auth from scratch.

Sessions vs. JWTs

Session cookies are server-stateful: the server stores session data and the cookie is just an opaque ID. JWTs are server-stateless: all claims are in the token itself. Sessions are simpler to revoke but require server-side storage. JWTs scale horizontally but can't be revoked without a blocklist (which reintroduces server state). Pick based on your actual constraints, not hype.