I am trying to create an auth server with nodejs and mongodb. I am trying to implement JWT auth with access and refresh tokens. I have read that you should store the access token in localstorage or memory and then pass the refresh token with an httponly cookie to protect against XSS attacks. The problem with the http only cookie is that you cant use this with things like mobile apps. The whole point of creating a rest api is so you can access the data from anywhere.

So what is the best way to handle different storage requirements of different devices and keeping them secure. Is there a good solution for either storing the refresh token on the browser without a httponly cookie? Should I just use localStorage even though its vulnerable to XSS attacks? Or do I need to create different endpoints for mobile and browser. Is there an industry standard for this? There is a lot of talk about using JWT but there does not seam to be a clear explanation of how to securely implement access and refresh tokens for mobile and browser apps alike.