Good question and one that trips up a lot of teams early on.
A few things that actually matter in production:
JWT is fine, but don't treat it as a session. Keep expiry short, 15 minutes is a common baseline, though your use case might call for less. Refresh tokens should live in httpOnly cookies, not localStorage. That one mistake alone accounts for a huge number of auth vulnerabilities in production apps.
Sessions still make sense for server-rendered apps, simpler to revoke, easier to manage. JWT shines more in stateless or API first setups. Pick based on your architecture, not the hype.
OAuth is the right call if you're dealing with third-party integrations. Don't roll your own if you don't have to. The surface area for mistakes is too large.
On the backend, never log tokens. Ever. It sounds obvious until you're debugging a prod issue at midnight and someone adds a catch-all logger.
The common mistake I see most is teams' focus on the happy path and forgetting token revocation. What happens when a user logs out? When a token is compromised? Having a clear invalidation strategy from day one saves a lot of pain later.
Start simple, but think about rotation and revocation before you go live, not after.