Ask HN: Authentication in SPA and native apps today

Trying to wrap my head around authenticating a React SPA/React Native mobile app and my head is nearly spinning.

Our prototype (jQuery + Spring Boot) uses Spring Security to provide cookie based auth. As we build our React front end trying to figure out what to secure it with suggests JWT + OAuth2. Down the line we'll want to add authentication against providers like Google/LinkedIn.

Considering the complexity of authentication these days is rolling your own still the way to go or do most startups go with Authentication-as-a-Service type offerings?