I use Auth0 in a React app. By default, auth tokens are stored in memory and and have be re-fetched on a browser reload. This causes a noticeable delay when reloading the page, particularly when the wifi isn’t great.

I can store these in local storage with the cacheLocation='localstorage' option, and when I do so the app feels much faster. Unfortunately, storing the tokens locally increases the risk from XSS attacks and is not recommended in production.

I don’t want to compromise security for performance. But is it really impossible to persist these tokens locally in a secure way? What about web workers? IndexedDB? Could the tokens be encrypted with an in-memory secret key? Is there no hope for a better solution here?