Handle identity at the boundary: cookies, sessions, tokens, and middleware-based enforcement.
Authentication and authorization are easiest to reason about when they are explicit. In Clojure web apps, auth is commonly implemented as middleware plus small pure helpers that interpret identity/claims as data.
This section covers practical patterns for sessions, cookies, token-based auth, and safe defaults that Java engineers will recognize from production web services.