I am using OpenId with Keycloak for the authentification management in a web application. I would like to use the session_state value given by Keycloak to manage session data using the OpenId definition of a session, not the browser definition. I mean I don't want to have two sessions when I log once and open my web app in two tabs.
Is it ok to store session_state in the client's browser local storage?
First I thought about the refresh token but then I read it's not recommended to store it outside a secured cookie. I don't find any similar recommandation about the session_state. session_state cannot be used to access any data right?