Questions about how refresh token JWT works?

Question

Java

Hello! Now I'm working on security and there are several questions about the refresh token for JWT. I implemented it like this
1: When logging in, the user receives an access token in the form of json and each time passes them to the header, and I store the refresh token in an http-only cookie.
2: There is also a mapping to the /refreshtoken path which refreshes both tokens.

Question: Why do I need to store the refresh token in cookies if I can also update it with an access token by accessing /refreshtoken, or do I need to check cookies when refreshing?

Answer 1

There is no need to store both of them in cookies. There is Local Storage.