Hi Emmanuel Gruffy Absolutely, you can do that. You can also implement interceptors in your apiClient wrapper so you have a more robust method to handle the life cycle. But your suggested approach should definitely work

Thanks M. Suman Patra , I’ll try to publish it as soon as possible

Thank you, Braydon Coyer !

Thanks for mentioning me (:

I’m not familiar with the packages/sdk you use (I assume you are the author, a disclaimer would’ve been nice btw) - so it might be easier, I’m not sure. But where’s the fun it that? I always prefer to have as much control as possible, if possible.

Great addition, thanks Martin Filteau, Eng., PMP 💪🏽

Hi Eliran Shem Tov , Thanks for the feedback! Yes, it’s considered as a bad practice. You shouldn’t store the token in local/session storage. In part 2 of the series I deal with the client side, and provide code examples, I believe you’ll find some useful information there!

I’m glad that you find it useful, Akash Raju M !

Hi Lihai Ben-Haim , Glad you like it! Let me answer your questions: You are right, it is still not bulletproof, however, it makes it much difficult to still the token from the memory, as the attack should be tailored to your exact app. Combining that with a short-living tokens makes the risk low, but still exists. The limit come from the refresh token expiration. When the user is active and logged in, we don't want revoke his access. If we want to limit the time for an active user, we can add a logic on the client side or the backend to force logout after a certain period. I didn’t took care of it here, but it is completely possible. encrypting the token is a good practice as it contains the identifier of the user inside it, and if stolen can give the hacker data that might be used in future attacks.

rasd sounds like a complete solution! I thought about setting a retry logic, but I didn’t want to complicate stuff since this post is very long as is. However, I do believe that calling the refresh endpoint few seconds before the token expires should cover 99% of the cases.