SPA, PWA offline mode, localStorage + rotating tokens?

[kit.zeller]

@dan.woda

The tokens rotate as an added security feature. All of this is outlined in the docs you have linked. There is plenty of debate out there about how vulnerable modern frameworks are to XSS and how many are automatically protecting against it, but that is a larger question.

The offline_access scope is a specific request for an access token. If you want to read about it specifically, you can see the spec here:

Final: OpenID Connect Core 1.0 incorporating errata set 1

Can I summarise this in an answer as: Yes. Rotating refresh tokens improve security when using localStorage and are the preferred choice when remaining authenticated offline is used?

In addition, for other people stumbling upon this topic who are entirely new to authentication/authorization; I found this useful to start understanding the aformentioned “scopes”:

https://auth0.com/docs/protocols/oauth2