How do I make the cookies HttpOnly?

这没必要。访问令牌和刷新令牌都是为了在你的应用的不同组件之间传递而设计的。反正你应用中的浏览器端也需要访问刷新令牌，才能正确维护浏览器会话。

🌐 This is not necessary. Both the access token and refresh token are designed to be passed around to different components in your application. The browser-based side of your application needs access to the refresh token to properly maintain a browser session anyway.