Where was the access and refresh token stored?

Access and refresh tokens are usually stored on the client side, but the choice of storage location depends on security requirements and the application's architecture.

• Access token is often stored in the application's memory (for example, in React state) or in sessionStorage, as it is short-lived and used for authorizing requests.
• Refresh token is typically stored more securely, for example, in an HttpOnly cookie, to protect it from XSS attacks, since it is used to obtain new access tokens.

Example:

// Access token in memory
let accessToken = null;

// Refresh token in HttpOnly cookie (set by the server)
// The client does not have direct access to this cookie

Storing in localStorage is not recommended for the refresh token due to XSS risk.