thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Refresh Token Rotation

Issuing a new refresh token each time one is used and invalidating the previous one, to limit the value of stolen tokens.

Definition

If a rotated (already-used) refresh token is presented again, the authorization server can detect reuse and revoke the whole token family. Rotation is recommended for public clients such as SPAs and mobile apps in OAuth 2.0 security best current practice.

Example

After a refresh token is reused from two devices, the server revokes all sessions for that grant.

Exam tip

Reuse detection is the key benefit.

Related terms