Recently, I've delved into creating my first back-ends as well. One important consideration is to hashify passwords for added security. Storing passwords in plain text is risky, so I recommend using a tool like bcryptjs to generate hashes that are much more difficult to crack. Hashed password attempts can then be verified against the stored hashes in your back-end.
If you haven't already taken this step, make sure to opt for bcryptjs instead of just bcrypt. The js version is specifically designed in Javascript, while the original is essentially a JS wrapper over C (if I recall correctly), which can lead to potential issues.
Additionally, consider implementing a handy npm package like satellizer for logins, including social logins. It integrates smoothly with the MEAN stack and although it may require some refactoring if you're currently using cookies, once set up, it simplifies the authentication process going forward. Including reputable and secure companies in your authorization process adds an extra layer of protection to your site, especially when dealing with complex social logins.
I hope this advice proves useful and timely for your endeavors! Best of luck in honing your skills!