Store Secrets in Secure Storage

[jankapunkt]

There are different ways to store secrets of all kinds (tokens,
client secrets) securely on a device or server.

Most multi-user operating systems segregate the personal storage of
different system users. Moreover, most modern smartphone operating
systems even support the storage of application-specific data in
separate areas of file systems and protect the data from access by
other applications. Additionally, applications can implement
confidential data by using a user-supplied secret, such as a PIN or
password.

Another option is to swap refresh token storage to a trusted backend
server. This option in turn requires a resilient authentication
mechanism between the client and backend server. Note: Applications
should ensure that confidential data is kept confidential even after
reading from secure storage, which typically means keeping this data
in the local memory of the application.