Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Why should a refresh token be stored in an HttpOnly cookie rather than localStorage, given that an access token is often kept in memory instead?
💻 Code Challenge | +75 XP
Implement a /auth/refresh endpoint that validates a refresh token, checks it against a server-side revocation store, and issues a new short-lived access token, along with a client-side interceptor that transparently retries a 401 request after refreshing.
A security review found that refresh tokens were stored in localStorage, and there was no server-side way to revoke a specific user's session after a suspected account compromise. Reorder the steps to fix both issues.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Storing a refresh token in localStorage instead of an HttpOnly cookie
// Wrong: readable by any XSS payload
localStorage.setItem("refreshToken", token);
// Correct: inaccessible to JavaScript
res.cookie("refreshToken", token, { httpOnly: true, secure: true, sameSite: "strict" });The Solution //
localStorage is fully readable by any JavaScript running on the page, including an injected XSS payload — storing a long-lived, high-value refresh token there means a successful XSS attack can steal it and maintain persistent unauthorized access far beyond a short-lived access token's exposure window. An HttpOnly cookie is inaccessible to JavaScript entirely.
The Error //
Issuing refresh tokens as purely stateless JWTs with no server-side record, making revocation impossible
// Wrong: no way to revoke this token before it naturally expires
const refreshToken = jwt.sign({ userId }, SECRET, { expiresIn: "7d" });
// Correct: persisted, revocable
await db.refreshTokens.insert({ token: hashedToken, userId, deviceId });
// Revocation: await db.refreshTokens.delete({ userId, deviceId });The Solution //
A purely stateless refresh token remains valid until its natural expiration, with no way to invalidate it early — if a device is lost or an account is suspected compromised, there's no mechanism to revoke that specific refresh token's access before it naturally expires, which could be days or weeks later.