Be aware of JWT when it comes to Login/Logout behavior. JWT is not a good fit for user facing login unless you have a session ID on the server. But then you cou

Be aware of JWT when it comes to Login/Logout behavior. JWT is not a good fit for user facing login unless you have a session ID on the server. But then you could as well use Cookies and a sessionID. So I would do a Login via Basic Auth or a Form post or a JSON post with username/password and then get some kind of token/sessionID/JWT which expires on the server side. The token might be encrypted on the server side with a secret only known to the server, never the client. Use the sessionStore to implement a proper session expiration scheme.