Detect refresh-token replay by rotating the token.
With refresh token rotation, each successful refresh returns a new refresh token and invalidates the one just used. Reuse of an older token is a signal that the token family may have been stolen.
Why this lesson?
A browser-based or native client needs long-lived delegated access without keeping access tokens valid for hours, while still detecting a copied refresh token.
Learning goal and prerequisites
Use the current refresh token once
The client presents its current refresh token to obtain a replacement access token. The authorization server authenticates or otherwise binds the client as required and validates the refresh grant.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
A refresh token is valuable because it can be exchanged for new access tokens over a longer period. That also makes theft dangerous. If the same refresh token can be reused many times, an attacker who copies it may continue renewing access alongside the real client.
Refresh token rotation reduces that risk by replacing the refresh token every time it is used. The client sends the current refresh token, and the authorization server returns both a new access token and a new refresh token. The old refresh token becomes invalid.
If an old token appears again, the server has evidence that the refresh-token chain may have been copied. Depending on policy, it can reject the request and invalidate the remaining token family so both the attacker and the legitimate client must reauthenticate.
Rotation is useful because it turns reuse into a detectable event instead of allowing two parties to use the same long-lived credential indefinitely. It still depends on secure client storage and careful server state. Rotation also does not make access tokens disappear; already issued access tokens remain governed by their own lifetime and revocation behavior.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.