There's no standard way. I myself prefer to keep auth out of the SPA part of things. It's more direct, simpler and easier to implement, and works perfectly with any sort of password manager.

To clarify, I mean restricting SPA routes based on session, not handling login on the client side

So I have an index.html that uses Rum and secretary for different routes. I want to restrict /users and I'm not sure manually checking session is a good way to do that or not

Just in case - you can't truly restrict anything on the client side, so I assume you mean simply preventing some routes from being used by accident in your code or something like that. You gotta restrict /users on the server side, restrict all the API endpoints that the /users page uses, and finally, check authorization on the client side - either when accessing that route or when creating the routing table at the very start.

Yes that is what I mean. I wouldn't rely purely on the client

I can recommend https://github.com/keechma/keechma-next (for example https://awardedtenders.au)