We've been working with SPAs which POST through credentials to the API and receive back a JWT (access token) and refresh token. The tokens are stored, depending on the 'keep me logged in', in session storage or local storage.

Looking at https://auth0.com/docs/api-auth/which-oauth-flow-to-use, they suggest (via OAuth 2.0, sure, but same concept I think) that SPAs should not be trusted with bearer tokens. Instead, we should do a silent auth by (in their case) having a hidden iframe and grabbing the access token directly.

Basically, my question is, why is the advice here, "SPAs cannot use Refresh Tokens"? In their example of using an iframe, I'm guessing there's a cookie being stored for their OAuth login domain - how is that inherently better?

What else might I be missing?

Edit: am I right in thinking XSS is more possible when using session storage, CSRF is more possible when using cookies, and so the answer is, if you have high confidence one of those (XSS/CSRF) is protected against, then that associated storage (session/cookies) is the way to go?

1 Answer 1


The security level is the same if you:

  • have HTTP header: X-Frame-Options: SAMEORIGIN

  • header: X-XSS-Protection: 1; mode=block

  • SSL with HSTS header

  • if you use cookie to protect it use CSRF tokens.

They say iframe just to hide refreshes from users no other then that, but security stays on the same level as without it if above is done.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .