Refresh Token Rotation Explained: What Happens When a Token Is Reused?
A refresh token is supposed to be used to obtain a new access token. After a successful refresh, the client receives a new refresh token. The previous one becomes invalid. That sounds straightforward. But what happens if the old refresh token is used again? Maybe an attacker stole it. Maybe the client retried a request. Maybe two refresh requests arrived at almost exactly the same time. These…
Refresh token rotation is a security technique used to limit the period during which a refresh token can be reused. After a successful refresh, the server replaces the old refresh token with a new one, rendering the previous token invalid. This prevents an attacker who may have obtained a stolen refresh token from continuing to obtain new access tokens indefinitely. Additionally, token rotation provides a mechanism for detecting token replay, where a previously used refresh token is presented again.
The difference between refresh-token rotation and replay detection lies in their purposes. Rotation involves issuing a replacement refresh token and invalidating the previous one after a successful refresh. Detection, on the other hand, involves recognizing that a refresh token that should no longer be usable has been presented again. For example, if the legitimate client refreshes first and then an attacker uses the same old refresh token, the server should detect this as a replay attempt.
A common mistake is to use a single revoked flag in the refresh token database to track token validity. However, this approach becomes inadequate after multiple token rotations. Consider a scenario where token A is revoked after rotation, and token C becomes the active token. If the server only checks for the revoked flag on token A, it may mistakenly allow token C to be used, even though it is part of a revoked token chain.
To address this issue, the server should maintain a link between refresh tokens, allowing it to revoke the entire chain when a token reuse is detected.
Implementing refresh-token rotation in a Spring Boot application involves several considerations. First, the server should maintain a reference to the active refresh token for each user session. When a refresh request is received, the server should first check if the provided token is valid and not already revoked. If the token is valid, the server should revoke the previous token and issue a new one, updating the active token reference. If the token is invalid or already revoked, the server should return an appropriate error response.
To detect token replay, the server can compare the provided token against the active token reference. If they do not match, the server should treat the request as a potential replay attempt and respond accordingly, such as by returning an error or requiring re-authentication.
When modeling the refresh token lifecycle in a database, it is essential to store not only the token hash but also additional information such as the user ID, creation timestamp, and expiration time. This allows the server to efficiently track the validity and revocation status of each refresh token. By maintaining a link between refresh tokens, the server can identify token families and revoke the entire chain when token reuse is detected.
To implement robust protection against token reuse, the server should include comprehensive tests that cover various scenarios, such as legitimate refresh requests, token theft, and replay attempts. These tests should verify that the server correctly revokes tokens, detects replay attempts, and responds appropriately to protect the security of the system.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
