A good authentication example, Sapper sessions, Svelte Store

{
  "@context": "/api/contexts/RefreshToken",
  "@id": "/api/refresh_tokens/0be45846-b76d-11e9-a437-0242ac120002",
  "@type": "RefreshToken",
  "token": "028e818976e38172f47751d8fada5c6adfb897e39bf5c9ee5f6b03e65b791624752aad51dd6338f30a643e18d7f571bc7b67aabd39fc444b69f15061dc754327",
  "user": "/api/users/73b4c436-b76c-11e9-a437-0242ac120002"
}

curl -X GET "http://127.0.0.1:8001/api/users/73b4c436-b76c-11e9-a437-0242ac120002" -H "accept: application/ld+json" -H "REFRESH-TOKEN: 028e818976e38172f47751d8fada5c6adfb897e39bf5c9ee5f6b03e65b791624752aad51dd6338f30a643e18d7f571bc7b67aabd39fc444b69f15061dc754327"

{
  "@context": "/api/contexts/User",
  "@id": "/api/users/73b4c436-b76c-11e9-a437-0242ac120002",
  "@type": "User",
  "id": "73b4c436-b76c-11e9-a437-0242ac120002",
  "jwttoken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJhdXRoLm5hYWJ1LmNvbSIsImF1ZCI6Indpc3ZpZHMubmwiLCJpYXQiOjE1NjUwMDE2NTcsIm5iZiI6MTU2NTAwMTY1NywiZXhwIjoxNTY1MDAxNzc3fQ.nCXsDOphrMN_v701Ma-8RPQvoTgolEOPbN-USR-kmY0lUe-CfbBxseujnr65j5lZc6B9BBvYYPSh733FnDRKjnZqC015IcUandVfniemfAGFUl-g-rISSKuVOLBx6UEZ2CMVxnS_SroAXUujcMI-p2ASeBbySYQn00AoWPXCmyDwKqZ7AnqsDXIeuGhcGke0-OktrzpPXrV1DfhnFXJw_16m2PfmfF0VAIWyvO-X4DJBiJS039D1hXt-KripS4eXtQLdq95dSdHH61bMCMudbznhEdhymq_ADBocEzgdJiscVpHz3x_seGuNWe7W4b084pT-_UaKqeg-dDT8S_2ypA"
}

const app = express()

// Configures the express session.
app.use(session({
    store: new RedisStore({host: 'redis', port: 6379}),
    cookie: {
        maxAge: 604800000,
    },
    secret: 'keyboard cat',
    resave: false,
    rolling: true
}))

// Setting default values and for debugging purposes
app.use(function(req, res, next) {
    console.log(req.session.user);
    console.log(req.session.refresh_token);
    if (typeof req.session.user === 'undefined') {
        req.session.user = false;
    }
    next()
})

// Initiates Sapper and adds the session variable to the Store.
app.use(
    sapper.middleware({
        session: (req, res) => ({
            user: req.session.user
        })
    })
)

<script context="module">
	export function preload(page, { user }) {
		return { user };
	};
</script>
<script>
	import Signup from '../components/Signup.svelte';
	import Login from '../components/Login.svelte';
	import Logout from '../components/Logout.svelte';
	import { stores } from '@sapper/app';
	const { session } = stores();

	export let user;
</script>

{#if !user}
<Signup/>
<Login/>
{:else}
<Logout/>
{/if}

<script>
    import { stores } from '@sapper/app';
    const { session } = stores();
    
    export let handleSubmit = async function(event) {
        if(!event.target.checkValidity()) {
            return;
        } 

        const response = await fetch("/login",
        {
            method: 'POST',
            headers: {
                'Accept': 'application/json',
                'Content-Type': 'application/json'
            },
            body: JSON.stringify({email: event.target[0].value, password: event.target[1].value})
        });
        if (response.status === 201) {
             // Sets the User to true in the Store so we do not have to refresh the page.
             session.set({ user: true });
        }
    }
</script>

const fetch = require('node-fetch')

async function login(email, password) {
    const { AUTH_SERVICE } = process.env;
    // Calls the external refresh token create endpoint
    const response = await fetch(AUTH_SERVICE + '/api/refresh_tokens',
        {
            method: 'POST',
            headers: {
                'Accept': 'application/ld+json',
                'Content-Type': 'application/ld+json'
            },
            body: JSON.stringify({email: email, password: password})
        });

    return await response;
}

export async function post(req, res, next) {
    // Call an authenication microservice to handle the authentication.
    const { AUTH_SERVICE } = process.env;
    if (AUTH_SERVICE) {
        const response = await login(req.body.email, req.body.password)
        res.status(await response.status);
        if (response.status === 201) {
            const data = await response.json();
            req.session.user = true;
            req.session.refresh_token = data.token;
            req.session.rt_id = data["@id"];
            res.end();
        }
        ... # error handling
    }
}

// logout.js (server route)
const fetch = require('node-fetch')

async function logout(id, refresh_token) {
    const { AUTH_SERVICE } = process.env;
    const response = await fetch(AUTH_SERVICE + id,
        {
            method: 'DELETE',
            headers: {
                'Accept': 'application/json',
                'Content-Type': 'application/json',
                // Adds the refresh token to the header.
                'REFRESH-TOKEN': refresh_token
            }
        });

    return await response;
}

export async function del(req, res, next) {
    // Call an authenication microservice to handle the authentication.
    const { AUTH_SERVICE } = process.env;
  
    if (AUTH_SERVICE) {
        // Here we can retrieve the information in the Session.
        const response = await logout(req.session.rt_id, req.session.refresh_token);
...