How would you implement refresh token rotation?

Question

Accepted Answer

Refresh token rotation is a security enhancement where each access token refresh request returns a brand new refresh token, and the previously used refresh token is revoked. This prevents an attacker who steals a refresh token from using it indefinitely, because once the legitimate client refreshes, the old token becomes invalid. Additionally, the server can detect token replay: if an old refresh token is ever used after a new one has been issued, it indicates theft, and the server can revoke all tokens for that user and trigger a security alert. ```javascript
const crypto = require('crypto');
const jwt = require('jsonwebtoken');
const db = require('./db'); // PostgreSQL client

// Helper: generate random token ID
const generateTokenId = () => crypto.randomBytes(32).toString('hex');

// Login endpoint – issue access + refresh tokens
app.post('/login', async (req, res) => {
  const { userId } = await authenticateUser(req.body);

// Generate unique refresh token ID
  const refreshTokenId = generateTokenId();
  const refreshToken = jwt.sign(
    { tokenId: refreshTokenId, userId },
    process.env.REFRESH_SECRET,
    { expiresIn: '7d' }
  );

// Store refresh token hash (not plain token) in database
  const tokenHash = crypto.createHash('sha256').update(refreshTokenId).digest('hex');
  await db.query(
    `INSERT INTO refresh_tokens (user_id, token_hash, expires_at) 
     VALUES ($1, $2, NOW() + INTERVAL '7 days')`,
    [userId, tokenHash]
  );

// Refresh endpoint – rotation logic
app.post('/refresh', async (req, res) => {
  const oldRefreshToken = req.cookies.refresh_token;
  if (!oldRefreshToken) return res.sendStatus(401);

let payload;
  try {
    payload = jwt.verify(oldRefreshToken, process.env.REFRESH_SECRET);
  } catch (err) {
    return res.sendStatus(403);
  }

const { tokenId: oldTokenId, userId } = payload;
  const oldTokenHash = crypto.createHash('sha256').update(oldTokenId).digest('hex');

// Check if old refresh token exists and is not revoked
  const dbToken = await db.query(
    `SELECT id, revoked FROM refresh_tokens WHERE token_hash = $1 AND user_id = $2`,
    [oldTokenHash, userId]
  );
  if (dbToken.rows.length === 0 || dbToken.rows[0].revoked) {
    // Token reuse detected – revoke all tokens for this user
    await db.query(`UPDATE refresh_tokens SET revoked = true WHERE user_id = $1`, [userId]);
    return res.status(403).json({ error: 'Token reuse detected, all sessions terminated' });
  }

// Revoke the used refresh token (rotation)
  await db.query(`UPDATE refresh_tokens SET revoked = true WHERE id = $1`, [dbToken.rows[0].id]);

// Issue new refresh token (rotation)
  const newTokenId = generateTokenId();
  const newRefreshToken = jwt.sign(
    { tokenId: newTokenId, userId },
    process.env.REFRESH_SECRET,
    { expiresIn: '7d' }
  );
  const newTokenHash = crypto.createHash('sha256').update(newTokenId).digest('hex');
  await db.query(
    `INSERT INTO refresh_tokens (user_id, token_hash, expires_at) VALUES ($1, $2, NOW() + INTERVAL '7 days')`,
    [userId, newTokenHash]
  );

// Logout – revoke the specific refresh token
app.post('/logout', async (req, res) => {
  const refreshToken = req.cookies.refresh_token;
  if (refreshToken) {
    try {
      const { tokenId } = jwt.verify(refreshToken, process.env.REFRESH_SECRET);
      const tokenHash = crypto.createHash('sha256').update(tokenId).digest('hex');
      await db.query(`UPDATE refresh_tokens SET revoked = true WHERE token_hash = $1`, [tokenHash]);
    } catch (err) { /* ignore invalid token */ }
  }
  res.clearCookie('refresh_token');
  res.json({ message: 'Logged out' });
});
``` Limits lifetime of a stolen refresh token: even if an attacker steals a refresh token, it becomes invalid after the legitimate client refreshes (e.g., every 15 minutes). Detects token theft: if an attacker tries to use an old refresh token after rotation, the server sees the token is already revoked and can take action (e.g., revoke all user tokens, alert security team). Prevents replay attacks: each refresh token can be used exactly once, making replay impossible. Enables better audit: every refresh operation is logged and creates a new token, providing a clear token usage trail. Store only a hash of the refresh token identifier in the database, never the plain token (defense in depth). Use short access token lifetime (e.g., 15 minutes) to force frequent refreshes and minimize the window for access token abuse. Set refresh token expiration appropriately (

How would you implement refresh token rotation?

Implement refresh token rotation by issuing a new refresh token each time the access token is refreshed, invalidating the old one, and storing token fingerprints in a database with user association to detect and prevent replay attacks.

How would you implement refresh token rotation?

Implement refresh token rotation by issuing a new refresh token each time the access token is refreshed, invalidating the old one, and storing token fingerprints in a database with user association to detect and prevent replay attacks.

Scenario Questions

Follow-up Questions