Hello, I'm currently working on a project where I have a Next.js frontend and a Nest backend, which I'm trying to implement OAuth on. I'm trying to understand the best way to securely pass the access token from the backend to the frontend after a successful OAuth process.

I've seen some suggestions to pass it through the redirect URL as a query parameter, but I understand this could be unsafe and isn't recommended. Another option I considered is to set it as an HTTP-only cookie, but the popular advice seems to be to only store the refresh token in a cookie and keep the access token in memory.

Could someone here share some insights or best practices on how this could be handled? What alternatives could be considered for securely passing the access token from my backend to my frontend? Thanks in advance!