expertSystem Design Questions
How would you design token refresh so that a stolen refresh token is detected quickly?
Implement refresh token ROTATION: every time a refresh token is used, issue a brand-new refresh token and invalidate the old one. If an already-used (old) refresh token is ever presented again, treat it as a signal of theft — immediately invalidate the ENTIRE token family (all descendants of that refresh token) and force re-authentication, since a legitimate client would never replay an already-rotated token.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response