How do you implement Refresh Token Rotation and secure storage in cookies?

Short answer

Store the Refresh Token in a Cookie protected by HttpOnly and SameSite; each use invalidates the current token and creates a new pair, and reuse of a revoked token invalidates the user's entire token family.

Explanation

To reduce the risk from a stolen, short-lived Access Token, use a longer-lived Refresh Token. Protect it from XSS by storing it in a cookie marked HttpOnly, Secure, and SameSite=Strict. With Rotation, when an Access Token is refreshed, the used Refresh Token is immediately revoked and replaced. If an attacker tries to use the old token, the system detects the breach and revokes all of the user's sessions.

Code example

res.cookie("refreshToken", token, {
  httpOnly: true,
  secure: process.env.NODE_ENV === "production",
  sameSite: "strict",
  maxAge: 7 * 24 * 60 * 60 * 1000
});

Common mistakes

• Storing authentication tokens and Refresh Tokens in the browser's localStorage, where XSS can steal them directly.

Follow-up questions

• How do Cross-Site Request Forgery (CSRF) attacks work, and how do you protect Node.js applications from them?

Sources

• RFC 9700 — Best Current Practice for OAuth 2.0 Security