This is my first time working with JWTs so I decided to ask here on Information Security as I'm very unsure about my approach towards JWT Authentication. I'm currently working on an API that will serve both mobile application and web page (React and React Native) and the authentication is currently being done with a JWT where both Access and Refresh tokens when the login is successful.
I currently have no mechanism to blacklist/revoke tokens but I'll work on it since the tokens carry roles on it's payload and tokens should be revoked when the user has it's roles changed.
The frontend developer said that he's going to store the tokens on cookies by using react-cookie to use on each request and refresh the token when it expires. Is that the correct approach and will the cookie be encrypted when stored? What security measures should I be concerned about with this approach? Thank you beforehand.