Thiết kế authentication flow cho SPA (React)?

Authentication flow cho React SPA:

• Login: POST credentials → nhận access + refresh token.
• Lưu access token trong memory (biến JS), refresh token trong httpOnly cookie.
• Axios interceptor: attach access token mỗi request; nếu 401 → dùng refresh token lấy token mới → retry; nếu refresh fail → logout.
• Route guard: PrivateRoute component check auth state.