We've been working with SPAs which
POST through credentials to the API and receive back a JWT (access token) and refresh token. The tokens are stored, depending on the 'keep me logged in', in session storage or local storage.
Looking at https://auth0.com/docs/api-auth/which-oauth-flow-to-use, they suggest (via OAuth 2.0, sure, but same concept I think) that SPAs should not be trusted with bearer tokens. Instead, we should do a silent auth by (in their case) having a hidden iframe and grabbing the access token directly.
Basically, my question is, why is the advice here, "SPAs cannot use Refresh Tokens"? In their example of using an iframe, I'm guessing there's a cookie being stored for their OAuth login domain - how is that inherently better?
What else might I be missing?
Edit: am I right in thinking XSS is more possible when using session storage, CSRF is more possible when using cookies, and so the answer is, if you have high confidence one of those (XSS/CSRF) is protected against, then that associated storage (session/cookies) is the way to go?