A stolen long-lived refresh token can prolong account access. Rotation and reuse detection help manage that risk.
Evaluation approach
Define old-token status and concurrent refresh behavior when issuing replacements. Account for mobile retries.
Application example
Two simultaneous refreshes should not accidentally destroy the legitimate session. Distinguish races from unauthorized reuse.
Limits and considerations
Rotation does not prove every device copy was deleted or the account is uncompromised.
Measuring refresh races
Send concurrent refresh requests in a controlled test and check that the client retains the valid result. Records should distinguish suspicious reuse from legitimate network repetition.
Checks and decisions
- Monitor reuse
- Test races
- Provide revocation
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.