Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
What does it mean if an API server receives a refresh token that has already been used once and rotated to a new value?
💻 Code Challenge | +75 XP
Implement refresh token rotation where each refresh invalidates the presented token and issues a new one, with detection logic that revokes all of a user's tokens if an already-invalidated token is presented again.
A security incident revealed that a stolen refresh token had been used by an attacker for two weeks before detection, since the token had no rotation and remained valid until its natural 30-day expiration. Reorder the steps to fix this going forward.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Using a static, non-rotating refresh token that remains valid and reusable for its entire lifespan
// Wrong: same token usable indefinitely, stolen or not
// (refresh token never changes across multiple refresh calls)
// Correct: a new token issued and the old one invalidated every refresh
await invalidateToken(oldToken);
const newToken = generateRefreshToken(userId);The Solution //
If a static refresh token is ever stolen, an attacker can use it repeatedly and indefinitely, up to its natural expiration, with the server having no way to distinguish the attacker's use from the legitimate user's. Rotation invalidates each token after a single use, limiting a stolen token's usefulness to exactly one refresh cycle.
The Error //
Detecting reuse of an already-invalidated refresh token but only revoking that specific token, not all of the user's tokens
// Insufficient: only the specific reused token is revoked
await revokeToken(reusedToken);
// Correct: revoke everything, since the scope of compromise is unknown
await revokeAllTokensForUser(userId);The Solution //
Reuse of an already-invalidated token is a strong signal that a broader compromise has occurred, but it's not possible to determine from that signal alone which specific device or session is actually compromised versus legitimate — revoking only the one reused token leaves the possibility that the attacker still holds a valid, un-reused token from elsewhere in the rotation chain.