I think there is no definite answer, it all depends on what task at hand do you have. Sometimes form auth is still good (use https!), sometimes oauth2 is better, jwt, or even custom auth, may be even 3rd party providers like auth0.com