3 ms·
Makes sense and I agree there. The code flow has the advantage of not being in the url. I'm still unclear if I have a best practice on how to store the refres
by taeric 2y ago
Makes sense and I agree there. The code flow has the advantage of not being in the url. I'm still unclear if I have a best practice on how to store the refresh token on a static website client. Feels off using local storage.
- apitman 2y agoIf you're in a situation where you would otherwise be using the implicit flow, can't you just throw the refresh token away? That should approximate the implicit flow.
- taeric 2y agoThis is what I'm currently doing. If my thread model includes malicious client, though, it doesn't work. Trivial to intercept.