There are two orthogonal choiceshere: 1. Cookies vs localstorage and an explicitly set auth header (or even a combination) 2. Stateful session token vs statel

There are two orthogonal choiceshere: 1. Cookies vs localstorage and an explicitly set auth header (or even a combination) 2. Stateful session token vs stateless JWT