title: OAuth 2 approach and refresh token security for SPA and Native Apps
body: <p>What is an appropriate secure way to use OAuth 2.0 with SPA applications and Native Apps?</p>
  
  <p>I have seen conflicting opinions in stack overflow and vendor documentation on whether OAuth refresh tokens should be stored in the browser for SPA's and in Native Mobile Apps.  </p>
  
  <p>For example here I have 3 links, one of them IETF including receiving refresh token in the App.  While several others including auth0 recommend against receiving refresh token on the client side.  </p>
  
  <p><a href="https://www.pingidentity.com/en/company/blog/posts/2018/oauth-recommendations-for-single-page-apps.html" rel="nofollow noreferrer">https://www.pingidentity.com/en/company/blog/posts/2018/oauth-recommendations-for-single-page-apps.html</a></p>
  
  <p><a href="https://tools.ietf.org/html/bcp212" rel="nofollow noreferrer">https://tools.ietf.org/html/bcp212</a></p>
  
  <p><a href="https://community.auth0.com/t/obtaining-refresh-token-along-with-access-token-in-a-spa/6476" rel="nofollow noreferrer">https://community.auth0.com/t/obtaining-refresh-token-along-with-access-token-in-a-spa/6476</a></p>
  
  <p><a href="https://developer.okta.com/docs/api/resources/oidc" rel="nofollow noreferrer">https://developer.okta.com/docs/api/resources/oidc</a></p>