title: Laravel Passport Refresh Token Storage
body: <p>I'm using Passport <a href="https://laravel.com/docs/7.x/passport#password-grant-tokens" rel="nofollow noreferrer">password grant tokens</a> with a Svelte front end. I can create and access the tokens just fine, as well as use the refresh tokens. My issue is storing the refresh tokens safely. Ideally Laravel would just return the refresh token as a cookie, and then accept that cookie on the <code>/oauth/token</code> route.</p>
  
  <p>I could even create the cookie client side, but would still have to figure out how to make Laravel parse it. I'm guessing there's no easy way to make laravel send a cookie, or accept a cookie of the refresh token?</p>
  
  <p>If not, how should I be storing the refresh token? Currently just storing it in a readable cookie, but that makes it bad for attacks. Would like something to persist refreshes, hence the cookie. Any advice would be great!</p>