# Security

Version: `2.9.8`

## Storage

- session data is stored under `sso_` keys
- the package encrypts persisted data at rest
- the frontend should use `getSsoSessionSnapshot()`
- do not read the storage directly from the host app

## Refresh token

- if the backend returns `refresh_token`, persist it
- if the backend returns `refresh_expires_at`, persist it too
- the SaaS should hash and store the refresh token server-side
- rotation must replace the local refresh token

## Resilience

- network errors must not log the user out immediately
- `invalid_refresh` is a real session failure
- timeouts, 502, 503, 504 are transient errors
- keep the session until the backend says it is truly invalid

## Good practices

- use `logout()` for sign-out
- do not clear storage manually to simulate logout
- do not treat local encryption as full protection against compromised JavaScript