Where to store tokens?

Question

JSON Web Token

There is a spa application on react, there is a refresh token and an access token. But where to store them, so as not to be stolen? Unreliable in cookies and localstorage. In the editorial office (storage) they also do not advise.
Google - in the examples they consider cookies, local storage, and at the end they write that you shouldn't do this in serious applications: D

Answer 1

In order not to be stolen, it is necessary to solve security issues, and you can store it in all the listed storages.