The Scenario
You are building the auth system for a Single Page Application (SPA). You have decided to use JSON Web Tokens (JWT). A common mistake is storing a long-lived JWT in `localStorage`, which is vulnerable to XSS attacks.
The Brief
Design a secure token lifecycle. Explain the difference between an Access Token and a Refresh Token. Describe exactly where the frontend should store each token, and how the backend should validate them.
Deliverables
- An architectural explanation of the Access/Refresh token flow
- Code snippets for setting the Refresh Token as an `HttpOnly` cookie in Express/Node.js
Submission Guidance
Focus on the storage mechanisms. Why is `HttpOnly` critical for the Refresh Token, and why is it acceptable to keep a short-lived Access Token in JavaScript memory?
Submit Your Work
Your submission is graded against the rubric on the right. If you pass, you get a public Badge URL you can share on LinkedIn. There is no draft save, so work offline first and paste your finished response here.