Auth State Sync

Covers the non-obvious parts of keeping auth state consistent across tabs, refreshes, and expiry. Skips CRUD auth setup — assumes tokens exist, storage is chosen.

Discovery

Before writing anything, answer:

1. Token storage: localStorage (cross-tab visible) or httpOnly cookie (invisible to JS)?
2. Refresh strategy: Silent (iframe/background fetch) or redirect-based?
3. Multi-tab logout: Must all tabs log out on one tab's logout?
4. Token rotation: Does the server issue a new refresh token on each use?
5. Framework: React, Vue, vanilla? (affects broadcast/listener placement)

Core Patterns