I'm working on a legacy application that issues JWTs with a short expiry time.
They do not have refresh token functionality implemented.
So obviously while using refresh tokens would be the right solution, for the sake of argument assume that's not going to happen.
It occurs to me that 'Hey I could just store the username and password locally and just re authenticate when the user gets kicked out'.
Suggests that localstorage would be a bad idea, and that access tokens should be stored in cookies instead. So sure, I could put the username and password into a cookie.
What's the security issue with doing this?