Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Refresh-token rotation helps an authorization server detect when an already-used refresh token is presented again. For public OAuth clients, current security guidance requires either rotation or sender-constrained refresh tokens—not rotation in every case. Rotation can contain a suspected replay, but it cannot tell the server who made the replay request, and responding to it may force the legitimate user to authorize again.
What refresh-token rotation does
An access token is presented to a resource server to access a protected resource. A refresh token is sent to the authorization server to obtain new access tokens, so someone who steals one may be able to keep obtaining access tokens. OAuth refresh tokens are optional, but their ability to extend access makes their protection important.
As an Amazon Associate I earn from qualifying purchases.
With rotation, a successful refresh exchange returns a replacement refresh token and invalidates the one just used. The authorization server keeps enough information to associate the old and new tokens. If the old token is presented again, the server can recognize that it has already been used and treat the request as a possible replay. RFC 9700 describes this approach as a way to detect refresh-token compromise, not as a guarantee that theft cannot cause harm. RFC 9700, OAuth 2.0 Security Best Current Practice.
What reuse detection tells the server—and what it cannot
A reused, invalidated refresh token is evidence that the credential has been presented more than once. It does not establish which request came from the attacker and which came from the legitimate client. RFC 9700 explicitly says the authorization server cannot determine which party submitted the invalid token; its described response is to revoke the active refresh token.
#1 Best Overall
That response cuts off continued use of the token family, but it can also interrupt the legitimate client. The user may need to complete a new authorization grant before the application can obtain fresh tokens. Rotation is therefore a containment tradeoff: it can expose replay and stop continued refresh, while suspected reuse can end an otherwise valid session.
What current OAuth guidance requires
RFC 9700, published by the IETF in January 2025, is OAuth 2.0 Security Best Current Practice. For public clients—clients that cannot reliably keep a secret, such as many browser and native applications—it says refresh tokens must be sender-constrained or use rotation. These are alternative replay-protection approaches, not a blanket requirement that every OAuth client rotate tokens. Read RFC 9700.
Sender constraint binds a refresh token to a particular client instance, so possession of the token alone is not enough to use it from another instance. RFC 9700 gives mutual TLS (mTLS) and Demonstrating Proof of Possession (DPoP) as examples. The RFC identifies the two approaches but does not prescribe one choice for every system.
The baseline OAuth 2.0 framework, RFC 6749, says refresh tokens must remain confidential in transit and storage, must be sent over TLS, and must remain bound to the client when the client can be authenticated. If the authorization server issues a replacement token, the client must discard the old one and use the new one. Read RFC 6749.
Rank #3
RFC 9700 also says refresh tokens should be bound to the scopes and resource servers the user consented to. It recommends expiration after a period of inactivity, with the authorization server choosing the interval, and permits revocation in response to events such as a password change or authorization-server logout. These controls complement replay protection; they do not replace it.
For browser-based applications, the RFC Editor’s current browser-app guidance, RFC 10017, says applications must either rotate refresh tokens on each use or use sender-constrained refresh tokens. Check the applicable standards version and the authorization provider’s behavior when implementing a browser application. Read RFC 10017.
Rank #4
Rotation and sender constraint: choosing an approach
| Consideration | Refresh-token rotation | Sender-constrained refresh tokens |
|---|---|---|
| Core protection | Replaces each successfully used token and can detect later reuse of the invalidated token. | Binds the token to a client instance; possession of the token alone is not sufficient for use. |
| What happens on replay | Reuse can expose a replay, but the server cannot determine which party made the invalid request. Revoking the active token can force fresh user authorization. | Depends on the sender-constraint mechanism and deployment; RFC 9700 identifies mTLS and DPoP as examples. |
| Implementation decision | The client must reliably persist the replacement and coordinate refresh operations that might overlap. | The deployment must support an appropriate binding mechanism, such as mTLS or DPoP, and the client must use it correctly. |
| Best fit to assess | Consider whether the provider supports rotation and whether the client can handle replacement tokens and recovery after suspected reuse. | Consider whether the infrastructure and client can establish and maintain the required client-instance binding. |
Assess provider support, client architecture, and the expected recovery experience rather than assuming one method is universally safer or simpler. A system may also have client types with different capabilities; confirm the applicable requirements for each.
Implementation details that prevent avoidable failures
Persist the replacement before the next refresh
After a successful exchange, update the stored credential to the new refresh token and stop using the old one. RFC 6749 requires a client to discard an old refresh token when a replacement is issued. A lost or delayed update can leave the client trying to use a credential the server has invalidated.
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Prevent overlapping refresh requests
Coordinate token renewal so that multiple requests do not concurrently submit the same one-time refresh token. Auth0’s Swift SDK documentation warns that concurrent renewals can produce a reused-token error and recommends its thread-safe credentials manager or otherwise synchronizing renewals. That is an Auth0 SDK implementation example, not a universal statement about how every provider handles races. See Auth0’s Swift documentation.
Plan the user recovery path
Decide how the application responds when the authorization server reports reuse or revokes the active token: stop retrying with the old credential, clear invalid local credentials as appropriate, and direct the user through authorization again. The exact error handling and session behavior depend on the provider and application; do not treat every renewal failure as proof of theft.
Keep baseline safeguards in place
- Protect refresh tokens in storage and send them only over TLS, as required by RFC 6749.
- Limit token scope and resource-server access to what the user consented to, consistent with RFC 9700 guidance.
- Check provider-specific token lifetime, inactivity-expiry, revocation, and rotation settings for the relevant client type.
Provider settings are product-specific
Auth0 documents rotation as enabled by default for its public third-party single-page and native applications, and documents settings for rotation, leeway, and token lifetime. Those defaults describe the specified Auth0 application types; they should not be generalized to other providers or client categories. Verify the current behavior and settings for the authorization server and application you deploy. See Auth0’s refresh-token rotation documentation.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
