I tried to find some information on how sessions work on an SSO and OAuth2 authorization server from the backend side but couldn’t find specific details. I need this information because I am building my own SSO and OAuth2 authorization server. The only information I managed to find is that they use cookies and an ID token, at least some of them, or access and refresh tokens.

I need to verify a token on both sides when refreshing the token or logging out from the account on the authorization server, both in the request and stored somewhere on the server. (And I’m not talking about the action of your application and the authorization server, but the user and the authorization server.)

I asked several friends, and each one told me something different, like I should store the refresh token as cookies, in a database, or in local storage. I also heard that I should use cache/Redis/sessions and that I shouldn’t use these either. While searching for information on the internet, I came across a statement that the refresh token should not be stored in cookies or local storage because it should remain confidential.

That’s why I decided to ask this question here, because I want to do it correctly and professionally like on those large services. Although large services probably use NoSQL databases and similar solutions.