# Secure access tokens stored in local storage using refresh tokens and getting access token only when required

**URL:** <https://community.auth0.com/t/secure-access-tokens-stored-in-local-storage-using-refresh-tokens-and-getting-access-token-only-when-required/102149>\
**Category:** Get Help\
**Tags:** apis, application\
**Created:** [March 9, 2023, 10:02am UTC](https://community.auth0.com/t/secure-access-tokens-stored-in-local-storage-using-refresh-tokens-and-getting-access-token-only-when-required/102149 "2023-03-09T10:02:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohamed.saseek](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@mohamed.saseek](https://community.auth0.com/u/mohamed.saseek)\
**Post date:** [March 9, 2023, 10:02am UTC](https://community.auth0.com/t/secure-access-tokens-stored-in-local-storage-using-refresh-tokens-and-getting-access-token-only-when-required/102149/1 "2023-03-09T10:02:28Z")

</div>

Hi, We have used Auth0-React SDK to enable SSO in our application. Due to our project’s limitations, We cannot create a custom domain for the universal login page. Hence, We enabled the refresh token rotation and local storage to achieve a persistent login across browsers.

Our application has only one API and requires the access token only when users are updating their profiles. So, I have made for following changes in my code.

- First, I reduced our secured API access token time to 5mins on the auth0 tenant.
- Then, I commented the audience passed to Auth0Provider so that access tokens will be opaque and cannot be used to hit our API.

```auto
  <Auth0Provider
        domain={Auth0.domain}
        clientId={Auth0.client_id}
        redirectUri={window.location.origin}
        onRedirectCallback={onRedirectCallback}
       // audience="https://test.aud.com"
        useRefreshTokens = {true}
        cacheLocation='localstorage'
     >
    	
    	<App/>
    </Auth0Provider>

```

- In Profile.js, I call this method to get access tokens when users click on the submit button, the access token will be expired in 5mins.

```auto
async getTokenDetails() {
        const { isAuthenticated, user, getAccessTokenSilently } = this.props?.auth0;
        let token, loggedInUserId;
        if (isAuthenticated && user) {
            token = await getAccessTokenSilently({
                audience: "https://test.aud.com"
            }).catch((err) => console.log(err))
            loggedInUserId = user.sub;
        }

        return { token, loggedInUserId };
    }

```

It works as expected but I’m not sure whether it is the correct approach or not.

Am I doing anything wrong here? Is there any alternate way to secure it? Any feedback or help would be much appreciated.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 13, 2023, 3:37pm UTC](https://community.auth0.com/t/secure-access-tokens-stored-in-local-storage-using-refresh-tokens-and-getting-access-token-only-when-required/102149/3 "2023-03-13T15:37:55Z")

</div>

Hi @mohamed.saseek,

We don’t typically do general security reviews here. I’m happy to help answer specific questions if you have them.

Also, I’m not sure I understand the purpose of commenting out the audience param. A user can manipulate anything that is sent to the client, and could easily make a request with the audience.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [April 24, 2023, 1:49pm UTC](https://community.auth0.com/t/secure-access-tokens-stored-in-local-storage-using-refresh-tokens-and-getting-access-token-only-when-required/102149/4 "2023-04-24T13:49:51Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.