This may edge upon a "best practice" type of question, but I'd like to explain my approach, list out my hypotheses and get constructive feedback.

Currently my setup consists of two servers;

• Node.js frontend server running Sapper/Svelte on localhost:3000 and a
• Django (not DjangoRestFramework), backend running on localhost:8000.

My Django sessions are being cached using django.contrib.sessions.backends.cached_db to a locally running Redis instance (and data forwarded to my Postgres instance).

I am handling my User model using views and urls I've defined in a Django app.

While building authentication; I am following the approach

• Run a fetch() POST'ing to locahost:8000/login or signup, using Django's authenticate, login, and User.* to create sessions.
• Then I return the session_key and email to the front-end which then sends these in the body for any request which may require authentication.
• In the backend, I match the session_key to the user_id using the e-mail sent to me in the request body to check if the session is valid.

Now since I have always used Django Templating, I hadn't had to ever maintain a separate session instance or had to think about sharing sessions. I feel this approach could be more python-ic?

At this stage, I've also had all the models, migrations done, this approach works, but seems to not be the best way to go about this.

Would appreciate feedback/critique.