How to properly authenticate?

Question

User identification

I need a theory.
What do you understand by good authentication? I tried JWT, but then I ran into a hate because of its security.
Should passwords be stored in sessions or in cookies?

Answer 1

1. JWT is not authentication, it's a token format. And he is not responsible for security because nothing of value is stored in it.
   
2. passwords should not be stored anywhere
   
3. For simplicity, you can start with cookies and store the session ID there
   
4. if you want something good and right right away, you should read about how OAuth2 and OpenID work. In order to start poke as easy as possible - take a free account on Auth0 and complete a simple manual in 15 minutes