> you have a server and a clientside JS app. How do you secure it?

I'd love to hear what others have to say, but I'd suggest encrypted session cookies. This is what some frameworks support out of the box (rails has docs here: https://guides.rubyonrails.org/security.html#sessions ). Would store the session in an HttpOnly secure cookie.

If you need to scale your server side horizontally, you'd use redis, a database or something similar for your session store.

This feels like a problem usually solved at the framework level (and has been for years) so maybe that's why there are not as many "best practices" docs around?

This OWASP document may be a useful read too: https://cheatsheetseries.owasp.org/cheatsheets/Session_Manag...