Hi all,
we have configured several OpenId Connect provider for different use cases. 
For the majority of the applications we use the authorization code flow, especially for the applications that call the API. The API gateway is protected by webseal that use AT to authenticate.

We have a problem related to the storage of the refresh token. We'd like to find the way to implement a "silent Authentication" (https://auth0.com/docs/api-auth/tutorials/silent-authentication) to avoid that the applications aren't obligated to store the refresh token.

In this article written by Philip Nye et Leo Farrell (https://www.ibm.com/blogs/security-identity-access/isam-and-single-paged-spa-applications/) I don't understand if the solution is to combine AT et session Cookie.
In the schema of the chapter "Handling Token Expiry Intelligently" , ther's a suggestion to renew the AT before its expiration, wich is practically the way? use a cookie? 

thank you

------------------------------
Ivana Campolongo
------------------------------