Secure authentication/authorisation in a Single-Page Application
<p>I am building the following:</p>

<ul>
<li>A JavaScript Single-Page Application;</li>
<li>A Node.js backend exposing a RESTful API, which will store user data;</li>
</ul>

<p>Users credentials (email/password) can be created via the Single-Page Application and are stored in the backend. There is no need for interaction with external providers, such as <a href="https://developers.facebook.com/docs/facebook-login" rel="nofollow">Facebook Login,</a> but it may be necessary in the future.</p>

<p>The Single-Page Application should interact with the backend via its RESTful API, once the user is authenticated using their credentials.</p>

<hr>

<p>I'm struggling to understand how to set up user authentication and authorisation, based on credentials, in a way that is both secure and compatible with the constraints of a Single-Page Application.</p>

<p>I found information about <strong>OAuth 2.0</strong> and <strong>JSON Web Tokens</strong>. I can't picture the way I should use these technologies to achieve my end goal, whether they are supposed to work together or independently, and I'm struggling to become aware of the pitfalls that come with each.</p>

<hr>

<p>Could you provide a walk-through of the steps and components needed in order to build a successful authentication/authorisation mechanism for a Single-Page Application with a custom backend, if possible covering the following topics as well: </p>

<ul>
<li>The benefits/drawbacks of using OAuth 2.0 compared to JWT or other methods;</li>
<li>Using cookies as opposed to storing tokens in different ways (e.g. LocalStorage) and security implications;</li>
</ul>