How parallel API calls silently break JWT refresh tokens in React apps

When multiple concurrent API requests hit an expired JWT simultaneously, each triggers its own token refresh call instead of sharing a single one. Modern backends using token rotation invalidate the previous refresh token the moment a new one is issued, causing subsequent refresh attempts to fail and forcing users back to the login screen. This race condition is invisible in local development, where token lifetimes are typically set to 24 hours, but surfaces in production with shorter expiry windows. The fix involves implementing a promise-queue lock mechanism in Axios interceptors, ensuring only one refresh request fires while all other failed calls wait and retry with the new token. Without this synchronization, a frontend app can inadvertently flood its own backend with redundant refresh requests and incorrectly invalidate active user sessions.