Passport.js Local Strategy with Server-Side Sessions: An Architecture Note
Architecture note on the minimal Passport.js design for first-party login: passport-local strategy with express-session backed by Redis, covering trust boundaries, operational checks, failure modes, and when to switch to token-based auth.