Add possibility to refresh tokens without access token.

[Bilanuk]

And i also implemented my version of @hassanrbh PR(#63)
Still needs a lot of work to be prod ready. Just want to share my idea.

[hassanrbh]

nice , a question is why you are storing both the access token and refresh token in the cookies ?

[Bilanuk]

nice , a question is why you are storing both the access token and refresh token in the cookies ?

Sry for not replying for too long.
I decided to store in cookies just because i thougth it was more secure than just using JS to manipulate both of them. And it was much easier to handle with react and axios.
Today i did a little research and found that storing both tokens in cookies can lead to csrf attack. And storing in localstorage can lead to xss attack.
Also the creator of this gem pointed out the idea: #47 (comment)
I think that the best idea to store tokens is just to let the users of gem to decide where to store each token (body/header/cookie).
So they can use your strategy as well:
#63 (comment)

[Bilanuk]

nice , a question is why you are storing both the access token and refresh token in the cookies ?

Sry for not replying for too long. I decided to store in cookies just because i thougth it was more secure than just using JS to manipulate both of them. And it was much easier to handle with react and axios. Today i did a little research and found that storing both tokens in cookies can lead to csrf attack. And storing in localstorage can lead to xss attack. Also the creator of this gem pointed out the idea: #47 (comment) I think that the best idea to store tokens is just to let the users of gem to decide where to store each token (body/header/cookie). So they can use your strategy as well: #63 (comment)

@Gokul595 what you think about different strategies of storing tokens?

[hassanrbh]

hey @Bilanuk yeah that pretty nice idea, just let the client to choose his own strategy