Web Security · Middle · Question 44 of 75

What is refresh token rotation?

1Sending the refresh token in every API request
2Changing the signing algorithm every day
✓Correct answer: Each time a refresh token is used, a new one is issued and the old one becomes invalid

Explanation

If an old refresh token is used again, the server knows the token family was stolen and can revoke all of it.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.