Web Security · Senior · Question 31 of 75

What is refresh token reuse detection?

1Allowing the same refresh token to be used forever
✓Correct answer: If a refresh token that was already rotated is used again, the server revokes the whole token family
3Storing refresh tokens in two places in case one is lost

Explanation

Either the legitimate client or an attacker used a stale token. Revoking everything forces a new login and cuts off the attacker.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.