title: What is the difference between using refresh token and Silent Authentication for SPA?
body: <p>As I understand you must not issue a refresh token for SPA. But there are options to get a new access token like silent authentication.</p>
  
  <p>To make things simple, you supply a refresh token to the Authorization Server(AS) and get a new access token. With silent authentication you pass current access token to some endpoint on the AS and if it is valid you get a new access token.</p>
  
  <p>So please correct me, because I do not understand why silent authentication is more secure approach.</p>