How to properly organize the authorization/authentication architecture?

Question

JSON Web Token

access token - localStorage refresh token
- cookie (httpOnly, Secure) I drew the following scheme for myself
for private routes (requests): the scheme indicates that in this case there is a redirect to the login (login) page, but the user can clear localStorage forcibly, but we cannot check from the front if the refresh token exists at the moment). 2. The second point, is it necessary to check the access token before requesting a delay? (That is, we start making a request, the token is expired - we learn about this not by 401 errors from the back, but by decoding and viewing the exp parameter - then we get a new one and continue to do the previous operation)


What is the best thing to do in these situations?

Answer 1

1. Yes, and do not care. They didn’t send a token (for any reason) - we don’t know you, go get a coupon address here
2. If we are talking about the front, then it’s good, but in practice it doesn’t play a role because the behavior of 401 unauthorized is still implemented (token can just withdraw)