I am using OAuth auth code flow to generate access and refresh tokens and then I store them in two browser cookies that are not HttpOnly and send them back too the client.
The cookies need to be non HttpOnly because the client needs to know if an access token exists to know if it should talk with the authorization server and perform a refresh token flow to get new tokens.
How bad is this security wise ? What are the risks when the refresh / access token get stolen ? What are some ways to mitigate these risks ?
Also, do you think PKCE can improve the security of refresh token in any way ? From what I understand, it can only improve the security of the auth code flow but after you obtain an access+refresh token it's not much different, you just don't need to use a secret when exchanging the refresh token for a new token pair. Thanks