Problem: Best way to refresh access token from AWS Cognito.
Background: I am new to web dev and have never done anything with security. I'm making a simple application with Vanilla JS/Jquery for the front end, and nodejs/express/AWS for the backend. As such, I decided to implement user accounts with AWS Cognito using their hosted UI. I am receiving the code and exchanging the tokens and storing the access_token in a HTTPOnly cookie (this is done on the server) so the user can use my app, while discarding the other two tokens. However, I am confused on the proper way to refresh the access_token. I understand that you want a short lived access token that is renewed with a refresh_token, and that you use the refresh_token to get a new access_token when it expires (and for AWS Cognito I would make a POST request for the new token), but I don't understand the best way to store the refresh_token. Some say store in a DB, others say store in a cookie, other say the benefit of JWT is being stateless and that I should not store the refresh token (but I dislike this last option because it would force the user to log back in once the JWT expires or they may not realize they are not logged in anymore). Then terminology I am not familiar with starts getting thrown around like PKCE, SPA, Silent Login, XRSF Cookies, and how each of this are supposed to refresh the token and protect (or are vulnerable) against XSS or various letters attacks. I then end up confused on if I my implementation is secure and is implemented properly. My question is two fold: Have I implemented it securely? How should the refresh token be stored to refresh the access_token?
BONUS: My urls that I use are: /oauth2/authorize?client_id=MYCLIENTID&redirect_uri=http://localhost:8080/auth&scope=openid&response_type=code For log in.
/oauth2/token?grant_type=authorization_code&client_id='+process.env.COGNITO_APP_CLIENT+'&redirect_uri='+redirURI For exchange, with headers: { 'Authorization': encoded, 'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': 'XSRF-TOKEN='+uuid_v4() },