login-auth question as a frontend javascript developer,,,

Question

Which type of login methods should be used where multiple servers are being used for the same site and request may go to any server for the same user?

option:

1. cookie-based login
2. session-based login
3. JWT based login
4. 2FA based login

Answer 1

a) cookie based login

bad option, cookie just another type of session, so see session

b) session based login

bad option, just cookie with less life time (when the user close window session's killed, cookie not). you need a center session cache server to know if somebody's authed or not. and this cache server is in reach of all your servers, so they can judge if this session, and plus if servers in different domain, you need to set cookie for manydomians at the same time (this only work for subdomains, you cannot set cookie of another top level domain, of course there are workarounds, like an api to set cookie or javascript read cookie from this domian and use in that domain). this way (cookie/session) is easy to understand but you see the center will cause delay, and setting cookies or proxy cookies with javascript very tedious

c) JWT based login

prefered, you just need to use the same key for all the servers, got the token and know who he is

d) 2FA based login

this is for security, not for auth in apis, the password always change, and you need another device to know the current pass, you can security other methods with 2FA if you like. I think maybe you mean OAuth

e) OAuth

an better and standarized method than cookie, but often this auth server only take care of auth and don't meddle too much other things into it, for your apis take a token from user and ask the auth server who he is