What should I use for session management and refresh tokens?

A solid, modern default is:

• Use secure, httpOnly cookies for session storage
• Use short-lived access tokens only if you need them
• Use refresh tokens only when you truly need long-lived logins across clients/devices
• Prefer server-side sessions for traditional web apps
• Prefer opaque tokens over JWTs for refresh/session tokens in most cases

Practical recommendation by app type

1) Traditional web app

Use:

• Server-side session store (Redis, database, or framework session)
• Session cookie: httpOnly, Secure, SameSite=Lax or Strict

This is usually the simplest and safest option.

2) SPA + API

Best options:

• Backend sets an httpOnly session cookie and your frontend uses fetch(..., credentials: 'include')
• Or:
  • Short-lived access token in memory
  • Refresh token in an httpOnly cookie
  • Rotate refresh tokens on use

Avoid storing tokens in localStorage if you can.

3) Mobile/native app

Use:

• Short-lived access token
• Refresh token stored in OS secure storage
  • iOS Keychain
  • Android Keystore / EncryptedSharedPreferences

Refresh token best practices

If you use refresh tokens:

• Make them long-lived
• Store them securely
• Rotate on every use
• Detect reuse and revoke the token family if a stolen token is reused
• Bind them to:
  • device/session id
  • user
  • maybe client type

What to avoid

• Storing auth tokens in localStorage unless you have a very strong reason
• Using long-lived JWT access tokens
• Putting refresh tokens in JavaScript-accessible storage
• Rolling your own crypto/session system

Good default stack

If you want a simple, robust setup:

• Session cookie + server-side session
• Redis for session storage if you need scale
• httpOnly + Secure + SameSite cookies
• Optional CSRF protection if SameSite alone isn’t enough

Rule of thumb

• If you control the backend and the app is browser-based: use cookies + server-side sessions
• If you need stateless API auth or multiple clients: short-lived access token + rotating refresh token
• If you’re unsure: cookies with server-side sessions is usually the safest choice

If you tell me your app type (SPA, Next.js, mobile, API, etc.) and stack, I can recommend a concrete setup.