Thanks for pointing it out Jose. In production environment, we aren't suppose to reveal the token, both in the client side as well as the server side. The steps I have mentioned are to be followed in the development environment. In some scenario, people often encrypt refreshToken and store it in database. Storing tokens in clear text in not recommended.

You can refer to this link for more detailed explaination:

stackoverflow.com/questions/59511628/is-it-secure…