1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who then returns a csrftoken and session (id/key).
Should I store these in a secure session storage such as reddis locally and give the client the same session keys for the auth or generate a session with different keys between us or send the auth session keys back to the client using secure http cookies? Your answer may change based on 2.
2) Once a few auth stages has been completed, an access token and refresh token are sent back. The refresh token has a life of two hours.
Should I timestamp it and create a server side function to refresh the token or should I send this back to the client for a client side JS script to then send back to my server which in turn would pass it over to the auth server.
Getting Tokens: Client -----> Details------> My Server-------> details----> Auth server Auth server -----> csrf token + session key ---> my server ?? to client?
If any of this seems unclear or needs to be explained a bit better, please ask. I'm new to building back-end with tokens/session keys.