tags: security, redis, nodejs, jwt
Refresh token rotation is easy to describe and annoying to get right. The idea: every time a refresh token is used, kill it and hand back a new one. Simple.
The part most write-ups skip: what do you do when someone uses a refresh token that's already been rotated away?
That's not an edge case you can ignore. If your client already exchanged token A for token B, and a request shows up later using token A, one of two things happened:
A retried request or race condition on your own client (rare, but happens)
