How do you handle authentication in a MERN stack app?

The standard approach uses JWT (JSON Web Tokens):

**Flow:**
1. User logs in → sends email + password to Express
2. Express validates credentials against MongoDB
3. If valid → generates JWT and sends to React
4. React stores JWT (localStorage or httpOnly cookie)
5. React includes JWT in Authorization header for protected requests
6. Express middleware verifies JWT on each protected route

**Backend (Express):**
```javascript
// Login route
app.post('/api/login', async (req, res) => {
const user = await User.findOne({ email: req.body.email });
if (!user || !bcrypt.compareSync(req.body.password, user.password))
return res.status(401).json({ error: 'Invalid credentials' });
const token = jwt.sign({ userId: user._id }, process.env.JWT_SECRET, { expiresIn: '7d' });
res.json({ token });
});
```

**Security best practices:**
- Use httpOnly cookies (not localStorage) to prevent XSS
- Short expiry + refresh tokens
- Hash passwords with bcrypt (cost factor 12+)
- HTTPS only