How should a JWT refresh token best be stored in-browser in a codebase that’s shared between a web application and a Capacitor-built iOS & Android application?

On mobile, it’s clear what to do — the backend returns access and refresh tokens and the refresh token is stored securely on the device (Keychain for iOS/KeyStore on Android).

However, it’s not so clear to me what to do for web app users.

It seems that I definitely can’t securely store the refresh token in browser localStorage because of XSS, but I also can’t set an httponly secure cookie directly from the frontend codebase.

If I wanted to try to conditionally set an httponly cookie from the server-side, I’d need for the backend to be reliably able to determine if the API caller is a mobile app or a web user, and I don’t believe that is achievable securely.

What is the best way to handle JWT tokens in shared web/mobile codebases without having to have duplicate API endpoints in the backend?

Thanks in advance!