I’m developing a captive portal. There is a website, there is a server on nodejsexpress, there is freeradius.
Question: Is it necessary to somehow protect the user account? For example, use tokens (refresh, access) to check the session on the site? Or am I already suffering from bullshit.

I have two options: either make these tokens, or just forget and just put the username, for example, in session and use it to pull all the data from the database.