Best practices SPA cookies (with custom domain) vs refreshtokens

Help
,
1

Hi all,

we have a backend API with an angular SPA client. We recently added custom domains to our tenants, to have a more unified user experience. Until now I also thought that we should migrate from using refreshtokens with rotation to cookies (refreshtoken =false) since third party cookies should not be blocked now.

Is this correct? Is there a recommended approach? I just saw a few threads where people suggest that refreshtokens might be more futureproof since browsers are continueing to block cookies in general.

If using cookies with custom domains, how should we handle local testing - will this still work?

I would really appreciate some recommendations or best practices regarding this topic :).

Best
Chris

3

Hi @chris_b

Welcome back to the Auth0 Community!

Refresh Token rotation It’s our recommended way of gaining the access token, due to, as you said, the current approach of browser to block cookies in general. You can read more about that here →

Thanks
Dawid

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.