This question is SPA application specific like reactjs or vuejs.

when implementing jwt, refresh token is recommended for several reasons.

I found that the main reason of this is increasing security by keeping access token short-live(ex an hour) while refresh token set long-live(ex a year).

I also found that the safest place to store the tokens is cookie as it prevents XSS attack.

However, if we store both access and refresh token in cookie, both are sent over every http request and both can be stolen. then what is the point of having refresh token?

I know if we have auth server and resource server separately, only using refresh token to the auth server can reduce the chance to steal. But I have only one server (resource auth) and I don’t think many apps implement auth server separately.

to sum up, question is is there any benefit to implement refesh token in terms of security?