When logging in, you will receive an access token that should be stored on the client-side (either as a cookie or in another form of storage).
The backend has an API with two types of requests:
- Protected (e.g., GET /user/:id) - where the access token must be sent for validation
- Open (e.g., GET /books)
Once the user navigates between screens on the client-side, it is recommended to have a protected route component that checks for the presence of the access token in memory. If the token is no longer valid (i.e., after receiving a 401 status code), it should be removed from memory without sending any additional requests.