Session management in small systems fails in predictable ways: sessions that never expire, tokens stored where scripts can read them, and shared logins that make audit logs useless.
The baseline: sessions expire after a reasonable idle window, tokens live in httpOnly cookies, not localStorage, and every user gets their own account. The shared login is the worst offender; it makes 'who did this' unanswerable.
None of this needs an identity provider. The framework's session handling, configured sanely, covers it. The discipline is in not taking the shortcuts.
