FLOW LGX · PROBLEM SOLVED · FEBRUARY 2026

Problem solved: keeping login tokens out of browser storage, with silent refresh

Storing a login token in the browser’s local storage is quick, and it is also the first thing an attacker looks for. On Flow LGX we wanted short-lived tokens that never touch storage — without users being thrown back to the sign-in page every few minutes.

About this project

Month by month, how a logistics platform for a Toronto client went from a simple brief to a live, multi-company SaaS product.

In short

Login tokens are kept in memory instead of browser storage and renewed quietly in the background. Users stay signed in through a whole shift, and their session is much harder to steal.

The problem

Long-lived tokens in local storage are convenient but risky: any script that runs on the page can read them. Short-lived tokens are safer but expire often. A dashboard that loads six tables at once can fire six requests at the exact moment a token expires — and a naive fix triggers six refreshes, or logs the user out in the middle of filling in a form.

The approach

The fix lives in one place — the shared HTTP client — so no page has to think about it:

  • The access token lives only in memory. It disappears when the tab closes and is never written to local storage.
  • A refresh token is kept by the server in an HttpOnly cookie that page scripts cannot read.
  • When any request comes back with “401 unauthorised”, the HTTP client starts a single refresh call.
  • Requests that fail while a refresh is already running are put in a queue instead of starting their own refresh.
  • When the new token arrives, every queued request is retried with it. If the refresh itself fails, the user is signed out cleanly and sent to the sign-in page.
  • The refresh call is never retried on itself, which prevents an endless loop.

What users notice

Nothing, which is the point. A warehouse user can leave a screen open through a shift, come back, and keep working. Behind the scenes the session renews itself, and the token that proves who they are is never sitting in storage waiting to be copied.

Lesson learned

Solve session expiry once, in the HTTP client, with a queue. Solving it per page guarantees duplicate refreshes and random sign-outs.