3 ms·

And more secure would be....what?

• withinboredom 5y ago
  Not localstorage. :) I've seen them in http-only cookies which is sent with every request but not inspectable by js. The server can automatically refresh the token every-so-often transparently without the client even being aware or able to influence it in any way.