Implement OIDC session management with refresh token rotation and silent renew in a single-page application

Steps

1. Use the authorization code flow with PKCE (not implicit flow) for SPAs; request offline_access scope to receive a refresh token if the AS supports it for public clients
2. Implement refresh token rotation: each use of a refresh token should return a new refresh token; discard the old one; configure the AS to invalidate the entire token family if an already-used refresh token is presented (refresh token reuse detection)
3. For silent renew without refresh tokens, use a hidden iframe pointing to the AS authorization endpoint with prompt=none; parse the authorization response from the iframe's postMessage; handle login_required error by redirecting the user for re-authentication
4. Store the refresh token in HttpOnly cookies or IndexedDB (not localStorage) to mitigate XSS-based token theft; weigh the CSRF risk of cookie storage against the XSS risk of JS-accessible storage for your threat model
5. Implement the OIDC session management check via the check_session_iframe (if the AS supports it) to detect cross-tab logout; alternatively subscribe to the Back-Channel Logout endpoint for server-initiated session termination
6. On access token expiry, use the refresh token to silently obtain a new access token without user interaction; handle invalid_grant (refresh token expired or rotated away) by redirecting to full login