title: where to store - access token and refresh token in OAuth 2.0
body: <p>I am new to OAuth 2.0 and I wish to know what is the best practice / location to store access token and refresh token in generic e-commerce web site.</p>
  
  <p>Question 1: <br />
  Where should access token and refresh token be stored in web sites? (cookies, web storage or local storage). And where big companies like google, dropbox store the access token and refresh token?</p>
  
  <p>Question 2: <br />
  If refresh token is stored on the client side (taking browser in desktop/laptop), isn't it possible that someone has physical gain on that device able to get the refresh token and device information and use it to generate access token on other place?</p>
  
  <p>Question 3: <br />
  I have see some post that suggest that refresh token should never be stored and known by client side. Then, where should refresh token be stored and how to reauthenticate in this case?</p>