What is the best way to make authentication and protect it in NodeJS?

What is the best way to make authentication and protect it in NodeJS | React?
I’ve seen a lot of ways who use cookies and who use local storage and who sends cookies through the header or through the body
I am confused by the many ways. I want to know what is the best way and how to protect it well from a hacker attack