**1. Should the client or the server take more security precautions?**

They should both take security precautions.

**2. What's the difference between local storage and session storage?**

Local storage persists for a domain even when a tab (session) is closed. Session storage only exists for the duration of the session (when the tab remains open).

**3. What problem does a JWT expiry time solve?**

It prevents JWTs from being valid forever so that old ones can't be used if discovered.

**4. Is a refresh endpoint protected or public?**

Protected.

**5. What would happen if a refreshed JWT was requested with a JWT that had already expired?**

The middleware will throw an unauthorized error.

**6. What does it mean to queue a callback?**

To set a later time of a function to execute.

**7. What does the clearTimeout function do and what argument do you pass into it?**

It clears a setTimeout() and takes the idea of the setTimeout() as its argument.

**8. For which of the following events should a refresh request be queued after?**

- A successful user registration request
- A successful login request
- A page load
- A successful API request to a protected endpoint for posting a comment
- A successful refresh request
- A push state navigation event
- A user logs out

A refresh request should be queued after a successful login request and after a successful refresh request.

**16. What is OIDC?**

An industry standard protocol for authentication systems.