I have been using Passport.JS session for a long time without really caring about security concern. For next project I thought of replacing session with JWT but security related concerns arise as I research more about JWT.
So if I use JWT for authentication, there are two types of tokens, an auth token and a refresh token. When I log in, I get a refresh token and this is used to communicate with authentication server to receive an auth token which will be used to get any sensitive information from the data server. The refresh token should be comparatively long lived, as opposed to the auth token which is short lived and be refreshed by the refresh token.
This refresh token should be stored somewhere. Common suggestion has been local storage but then a token that can generate infinite number of auth tokens is exposed to the client side - this doesn't feel safe.
Same applies to sessions. When we store sessions using libraries like Passport.JS ID is (usually) serialized into session storage. Then another client can take the serialized session and use it to authenticate in another device (is this true?).
So none of these two methods seem very secure (if what I have said above is correct). Are we using JWT and sessions with the mentioned security risks or am I understanding this wrong?