I'm working on a single-page sessionless app with OAuth2 login and a "Remember me" checkbox. When the user checks "Remember me" on login I store the refresh token in LocalStorage for 30 days. It feels a little insecure to just leave it there until the user logs in again. What is the best practice for persisting refresh tokens in a sessionless environment?

1 Answer 1


If you want to guarantee they will remain logged in for 30 days then that is the most secure way to do it. And yes, it's not secure at all. It's a usability / security decision you will have to make depending on the risk. You can do something like encrypt it but you would have to store the key in local storage too so it's not any safer.

  • I was thinking I could store the key on the server and decrypt it before I make a request for a new access_token.
    – jwerre
    Commented Mar 1, 2017 at 19:37
  • Yes but if somebody were to get access to the encrypted token, couldn't they just use that to log in if the key used to decrypt it is on the server? they would just log in and your server would automatically decrypt it. You would need to tie the user to an encryption key, but it's a circular reference. How could you ensure that the user with the encrypted token is authorized to access the Key to decrypt it
    – joe
    Commented Mar 2, 2017 at 5:07
  • Yes, these are the kind of questions I had. Encryption seems a little redundant I guess.
    – jwerre
    Commented Mar 2, 2017 at 20:11
  • Yea there isnt really a way to make this any more secure if this is the route you choose.
    – joe
    Commented Mar 3, 2017 at 3:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .