Which Layer Should Handle Token Refresh in Vue Storefront’s Offline Cache?

Goal

Maintain least‑privilege authentication while ensuring seamless user experience in a Vue Storefront PWA that uses offline GraphQL caching.

Context

Vue Storefront stores query results, including authentication artifacts, in IndexedDB for offline support. When a backend session expires, the cached token becomes invalid, yet the framework does not automatically refresh it. The current design leaves token renewal responsibility ambiguous: should the service worker intercept 401 responses and refresh the token, or should the host application handle it?

Unresolved Decision

Placing refresh logic in the service worker could centralize security and reduce exposed code, but may complicate cache invalidation and user flow. Delegating to the host app simplifies implementation but risks token leakage and inconsistent refresh timing.

Specific Questions

• Can the Vue Storefront service worker detect an expired token in IndexedDB and trigger a silent token refresh?
• Does delegating token renewal to the host application compromise least‑privilege security guarantees?
• Which approach—service worker or host app—provides the best balance between security, performance, and user experience?