title: Refreshing token in Oauth2 Implicit Grant Flow and 3rd party cookies
body: <p>I wonder how to deal with refreshing token in Oauth2 Implicit grant 
  flow in 2019 when major browsers have 3rd party cookies disabled by default. </p>
  
  <p>Some details:</p>
  
  <p>Current setup:</p>
  
  <ul>
  <li><p>UI SPA app under <code>ui.example.com</code></p></li>
  <li><p>Identity Provider (UAA by CloudFoundry) under <code>uaa.api.example.com</code></p></li>
  </ul>
  
  <p>Scenario:</p>
  
  <ul>
  <li><p>when user signs in, Identity Provider sets cookie with user details for domain <code>uaa.api.example.com</code> and returns JWT in the redirect's <code>Location</code> header.</p></li>
  <li><p>JWT is stored in the local storage (for <code>ui.example.com</code>), but it's valid only for 1h so I'd like to refresh it.</p></li>
  <li><p>refreshing is possible with <code>prompt=none</code> query param sent to IDP authorization endpoint (process is well described in <a href="https://auth0.com/docs/api-auth/tutorials/silent-authentication" rel="noreferrer">Auth0 guide (it's not UAA but flow is the same</a>) </p></li>
  <li><p>in every 20m hidden iframe with src set to <code>uaa.api.exmaple.com/oauth/authorize?prompt=none</code> is created what starts the signing in process without requiring user to provide his credentials. When process ends, new JWT returned in the response is stored again in the local storage.</p></li>
  </ul>
  
  <p>Problem:</p>
  
  <ul>
  <li><p>When third party cookies are allowed, browser adds the IDP's cookies to the request made by an iframe, so flow works and I get new token in the response.</p></li>
  <li><p>When third Party Cookies are disabled in the browser's settings, iframe doesn't have an access to its own cookies, so instead of new JWT, error <code>login_required</code> is returned. Inability to access cookies by iframe makes token renewal impossible to use</p></li>
  </ul>
  
  <p>Question:</p>
  
  <p>Is there any solution for my issue with 3rd party cookies? </p>
  
  <p>If not, are there any alternatives for Implicit Grant flow and SPA that I could use to sign in and refresh tokens?</p>