(This is a followup to my question about a general security scheme here)
As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with a short-lived access JWT and a long-lived, revocable refresh token. After some consideration, it seems like the best way to store these client-side would be as cookies with
Secure set, as well as
HttpOnly should protect against XSS attacks accessing the tokens, and
SameSite should provide some protection against CSRF.
However, if both tokens are sent with every request, is there any benefit to having separate access and refresh tokens? I suppose there's still the benefit of not requiring a database lookup while the access token is valid, but I thought part of the advantage of refresh tokens was that their exposure could be limited by only sending them on infrequent requests. Would it be better just to have a single, revocable token that requires a database lookup on every request?