FrontendHaltSecurity·Advanced·Conceptual·1 min read
Why is refresh-token rotation used?
Short interview answer
Each use of a refresh token issues a new one and invalidates the old, so a leaked refresh token that gets used by an attacker is detected the next time the legitimate client tries to use its now-invalidated copy.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.