hard20 pts · first answer countsauthenticationsecurity

Refresh token rotation

You rotate refresh tokens: each use returns a new refresh token and invalidates the old one. What should the server do if an already-used refresh token is presented again?

A.Accept it, because it was valid onceB.Treat it as likely theft and revoke the whole token family, forcing the user to log in againC.Return a new access token but no new refresh tokenD.Ignore it and log a warning only

← Two buyers, one item left Hydration mismatch with time →