I think we don't need to reinvent the wheel for handling user session, especially in web based application. There are common best practices that everybody already know such as using jwt, https and store in http only cookie
a little bit oot, but just installed tailscale on my dev stack (ec2, bare metal at home and my macbook air). mindblown by its simplicity and "it just works". Use it for logging purposes (ELK is too heavy for free tier ec2) and CI/CD (again, too heavy for my free tier ec2)