CodeParkA refresh token gets new access tokens without a new login. Rotation replaces it on every use. Reuse detection catches a stolen refresh token being replayed.
Refresh tokens: The client holds a short-lived access token and a longer-lived refresh token. When the access token expires, the client sends the refresh token to the token endpoint. It gets back a new access token.
Rotation: Every refresh also issues a new refresh token and invalidates the old one. The server tracks the chain (the token family) of all refresh tokens that come from one login.
Reuse detection: This is the benefit of rotation. Sometimes a refresh token that was already used comes back again. That means someone is replaying a stolen copy. The server can't tell if it's the attacker or the real client. So it revokes the whole chain, which forces a new login, and it logs the event.
Also:
- Store refresh tokens hashed.
- Bind them to the client.
- Give them an absolute lifetime.
- Allow a short grace period for real retries. These happen when two requests race on a slow network.
- A refresh token gets new access tokens without a new login.
- With rotation, each use gives a new refresh token and invalidates the old one.
- Reuse of an old refresh token is a sign of theft.
- On reuse, the server revokes the whole token family.
- Store refresh tokens hashed and give them an absolute lifetime.