Refresh Token Rotation Without Disrupting Legitimate User Sessions

A refresh token's long-lived nature makes it a target, since an attacker holding a copy can keep minting access tokens until the grant expires or is revoked. OAuth 2.0 Security Best Current Practice (RFC 9700) recommends sender-constrained refresh tokens or rotation for public clients. Implementing rotation is difficult in production because retries, multiple tabs, and concurrent background refreshes can look like replay attacks and revoke real users. The guidance calls for durable server-side state tied to each token family, atomic consumption of the active token during refresh, and family-wide revocation when a consumed token reappears. A narrowly scoped idempotency allowance can handle lost responses without weakening replay detection.