🔐 Customized Simple JWT for RESTful APIs with Django Rest Framework(DRF)

🧩 Implements a secure token handling strategy for modern SPAs:

• Access Token: Held in memory or SPA app state to minimize exposure.
• Refresh Token: Safely stored in localStorage to maintain long-term sessions.

✅ Pros of this Approach:

Not persistent → gets wiped when the page reloads. Not accessible to scripts after reload, minimizing exposure if XSS occurs. Cannot be stolen via XSS unless an attacker already controls JS runtime memory (rare). Every time a token is refresh → issues both new access & refresh tokens, invalidate the old ones(both acess and refresh token).

⚠️ Cons of this Approach:

Loses token on refresh → user needs silent refresh logic (with refresh token). LocalStorage is accessible via JavaScript, so if an attacker injects malicious JS (XSS attack), they can steal your refresh token.