I'm developing a simple web application in node.js. Users can log in from any page in the application, so I handle authentication in the server's code and logic, and the application's server-side code checks to see if a couple session variables are set. If they are, the application continues with user-specific information.
I'm unsure if this is the best way to handle the authentication logic. Should I move all authentication completely over to the application's code and only have the server listen and pass requests along, or, since the server is setting the session anyway, should I have it control back-end authentication logic as I'm handling it now?
In the end, what I'm really asking is: Conceptually, where should authentication be handled? In the server's code, or in the application's server-side code?
Edit: To be more specific, it's a public application on the internet. The logic that I'm questioning is entirely the server-side logic. Thank you for pointing that out to me. I edited my title to make it a little more accurate.