I'm building an authentication system for my SPA, and I've decided to store access token in-memory and refresh token in an httpOnly cookie.
Now, the edge case I'm concerned about is when the app is reloaded, it would hit refresh token route to get access token. If the refresh token is valid, I'll generate a fresh set of access, and refresh tokens and pass those to the client.
However, how do I verify if it is the real user who is refreshing tokens? Since, I'm storing access token in my redux store, I lose it on page reload, otherwise I could have sent it along with the request.
So if refresh token is stolen somehow, any non-browser client can make the request /refresh-token and get new set of auth and refresh token.
How do I protect my /refresh-token route?