I am building a website using .net. The plan is to use the strava api to get activity data of the user.
Currently the user will need to accept this strava prompt every time he reloads my site:
I got the auth flow working but my question is how to keep the user logged in. If I only store the tokens on my server I won't recognize the user on reload (or I have to use separate authentication). However if I store the tokens on the client the user will be able to make requests to the strava api on behalf on my application.
I tried to add custom jwt authentication to my server but don't like the complexity this is adding. I want to avoid it if possible.
Which of these is the standard way of doing it? Or is there a different strategy I am not seeing?
I don't know about Strava API, but in general it is okay to save oauth refresh tokens in the browser localStorage or cookies.
In OAuth2 you have the concept of public and confidential clients. If your client is public, it is known that the user may extract that token for other usages.
The user is responsible for the usage of the token, I don't think Strava will find you accountable for misusage.
Confidential client usually have client_secrets and refresh token never leave the server. I didn't see client_secrets in the strava documentation, so it looks like they are using only public clients
https://oauth.net/2/client-types/