Best Authentication Architecture for Enterprise React Apps?

Hey everyone 👋

I’m working on a large-scale enterprise React app and currently redesigning the authentication/session architecture.

What’s your preferred modern production-grade login/session approach for React apps today?

Current stack:

• React + TypeScript
• Zustand
• Axios
• TanStack Router
• Enterprise multi-tab app

Main goals:

• Secure auth
• Fast login/logout UX
• Multi-tab session sync
• No localStorage token leaks
• Smooth refresh flow
• HttpOnly cookie architecture

Would love to know:

• Your preferred architecture
• Common mistakes to avoid
• Best practices for refresh/session handling
• How you handle logout + new tab session sync

Thanks 🙌