I have heard that JWT tokens are recommended to be stored as follows:
access_token in the application memory (as an example I was given - closures)refresh_token in cookie entries (HttpOnly)At the moment, my access_token is stored in localStorage and is taken to check the authorization status:
isLoggedIn: state => !!state.token
in Vuex
refresh_token is stored in cookies.
I want to get away from this. I 'm wondering how to still store access_token in the closure ?
Keeping the token in a closure will depend on the exact implementation that you use and is a bit hard to demonstrate without any example code. Maybe you could post parts of the code where you're getting the access token and where you're using the access token?
To store the token in the memory, it doesn't have to be a closure, though. You can even keep it in vue's state - if you don't use any plugins which persist the state in local storage.
If you want to keep all of your tokens in a http-only cookie, you can achieve it by adding a lightweight backend component, which will handle the tokens for you. It adds a bit of complexity to your app, but increases security. It's what we call at Curity the Token Handler Pattern: https://curity.io/resources/learn/the-token-handler-pattern/