security - Writing my own Authentication Backend -

i'm developing web app using angular2 , scala. , instead of using big frameworks spring security you, i'm thinking using libraries , write system myself.

i plan use jwt libraries authenticate requests. use hashing libraries encrypt password storage in db. other things need consider make system secure? think need think csrf , xss? else?

thanks lot!!!