Can I use refresh tokens in SPAs? if so, Where should I store it?

HeyI've seen a lot that people say that refresh tokens shouldn't be used in SPAs because it's long-lived and if it's compromised then it's very dangerous. or some people say the reason refresh tokens shouldn't be used with in SPAs is something named "client secret" which shouldn't be stored in users' browsers.So I have a few questions about this claims:1- Is there anywhere other than cookies or Session/Local Storage to store tokens? (I don't understand why storing refresh tokens in these places is less dangerous in non-SPA applications, is there anywhere else to store this data that I'm overlooking? I'm quite new to web programming and I've only been programming SPA apps.)2- AFAIK, client secret is some secret that you need to send to your Auth server to confirm that it's a request issued by your application, why should this piece of data be stored in users' browsers? why can't I append client secret to the user's request myself in an intermediary server?3- I guess it's all about tradeoffs here. localStorage and sessionStorage are vulnerable to XSS, cookies are sent in every request (although with SSL enabled, I don't understand the downside here) but are immune against XSS and almost against CSRF (using same-site attribute), long-lived access tokens are harder to revoke and need hitting the db for every request to check if they are not revoked, refresh tokens offer a better mechanism to revoke tokens and you don't need to check the db as frequently but what if there's some emergency and you want to revoke the user access token right away? you need to have a mechanism in place to do that too (in-memory blacklist in your resource server?). The whole authentication and authorization thing is getting very complicated.4- What strategy should I use for revoking previously issued refresh tokens? say refresh tokens expiration time is 6 months and a user copy their refresh token and demand a new one with their username/password, should I revoke their previous token? if so, is it done by storing users' refresh tokens in a database? and if refresh tokens are stored in a database, why do I need to sign these tokens and use something like JWT? doesn't any random string works? because we're checking if the token exists in our trusted db after all.

Submitted September 17, 2020 at 09:24PM by fiveMop