A brief summery:
- Is this approach secure? Specifically:
- Is sending the username and password through JSON safe if done over HTTPS? How would I prevent unauthorized domains from making calls to this endpoint? Furthermore, how would I prevent programmatic logins?
- Should the refresh tokens be hashed before storing them in the database, or am I just being paranoid?
- If the client were a web browser, how would I securely store the refresh token on the client?
You guys handle security questions far better than Software Engineering does but I didn't want to dump it on you if I'm misjudging how it would fit here.