Isn't it a good way to set access token as http only cookie like we do with refresh token? Then we don't need to send access token as response when user logged in.
If we do like that, it ensure access token will also send with every requests. Also we don't need to set Authorization header for requests(because access token is available in http only cookie and it will send with all the requests). Also it prevents XSS attacks for access token because of JS cannot access http only cookies. Could anyone please explain this?
If I do that, I'll not able to use data encoded in access token in the client side app. But I can send that required data as json response and store them in local storage. I guess it's secure than storing access token in the local storage. Is that the problem of my question?