I'm looking for help understanding how to setup authentication for a NextJS frontend app running on port 3000 and a separate NodeJS REST APIrunning on port 3001, preferrably using passportjs. The idea here is to start authentication from the REST API side and utilize that authentication on the frontend to authorize the user for restricted pages as well as authorize the user on the API for restricted API endpoints. In this case both apps will run on the same domain but on different ports. I also wanted to design this system around the idea of potentially creating native mobile android/apple apps to utilize the API in the future as well, I probably won't actually do that but I want to leave the option open if possible.

The question here then is how to achieve this.

- Sessions seem like the better answer because they probably fit the use case better and are more secure than JWTs, but from my research sessions cannot be shared across apps on different ports even if the apps are on the same domain (localhost in this case). Additionally I doubt a session created by the API could be utilized in a native mobile app either.

- JWT seems like it could be the choice given the above, but seem to have pretty severe security vulnerabilities and don't seem to be easily revokable like how sessions would be.

- There may be other options, but if there are I'm not aware.

Honestly I'm not trying to become the worlds foremost expert in authentication. I just want a simple authentication system I can use for my specific use case on my twitter clone because I need to add this project to my portfolio.