Why can't I store an oauth refresh token in the browser? : <p>I want to store an oauth refresh token in the browser. The reason I want to store it there is so that the app can refresh the access token and let the user continue their session uninterrupted. I also want to eliminate the need for any kind of cache on the server to store the tokens, thus making it stateful.</p>

<p>I'm told that storing the refresh token in the browser is wrong because it's insecure.</p>

<p>I think it's OK because:</p>

<ul>
<li>The tokens would be stored in httpOnly, secure session cookies so they shouldn't be vulnerable to XSS or man in the middle attacks and they will be discarded when the user closes their session.</li>
<li>All communication to the server is done via HTTPS</li>
<li>The refresh token can be invalidated if suspicious activity is detected</li>
<li>Most importantly you can't use the refresh token unless you know the client secret which would be known only by the server.</li>
</ul>

<p>Am I wrong to think it should be OK? Please explain why!</p>
