Tokens in Web Storage (sessionStorage by default), so a reload keeps the session. Anything script in the page can read, it can read: pair this with DPoP so the stored tokens are useless without the non-extractable key.
Optional
Tokens in Web Storage (sessionStorage by default), so a reload keeps the session. Anything script in the page can read, it can read: pair this with DPoP so the stored tokens are useless without the non-extractable key.