title: What is the correct way to set up authentication and authorization for a web application
body: <p>bare with me as I'm trying to grasp a full-stack website as one developer building it. The following is my method of building the website.</p>
  <p>I have a front-end web application built with react. I'm planning to host this with next.js/Vercel. Fundamentally, This website will feature signup, sign-in to access to access website features, user data and comments. (currently hosting locally).</p>
  <p>the backend is built on Express with PostgreSQL. under a restAPI architecture. (currently hosting locally, separate port from frontend, later with AWS/Heroku or something).</p>
  <p>From my understanding is, the frontend will communicate to the backend via HTTP protocol. Upon providing credentials, express-session will instantiate a session and give a session cookie to the client side.</p>
  <p>When I look up backend express server tutorial, I often see the an express server provides restAPI, sessions, and html on the same domain. Obviously I've separate the client side and database side on their own. So I'm asking, is this a a reasonable/conventional way of building a website?</p>