intermediateRefresh Tokens & Session Lifecycle
What is refresh token rotation, and what attack does it defend against?
Every time a refresh token is used, the server issues a brand-new refresh token and invalidates the old one. If a stolen refresh token is ever replayed by an attacker after the legitimate user already rotated it, the old token is rejected — and detecting that reuse is itself a signal the token was compromised, letting you revoke the whole token family immediately.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response