• Authentication
• security
• session management
• token theft

Web applications always have to find a balance between the security of user sessions and a good user experience. Token-based authentication is well suited for scalable systems, but it also carries a significant risk. If a refresh token is stolen, an attacker can maintain long-term access without being detected. This text explores how refresh token rotation and reuse detection can work together to prevent stolen sessions.

The Foundation of Token-Based Authentication

Token-based authentication has become a standard approach in modern web applications due to its statelessness and scalability benefits (Ishii, 2020). In such systems, access tokens support stateless authentication, while refresh tokens enable longer-lived session management.

Security Risks of Stolen Refresh Tokens

Refresh tokens are used to obtain new access tokens and typically remain valid longer than access tokens (Hardt, 2012). Because of this, compromised refresh tokens can pose more serious security risks than compromised access tokens. Such a compromise may lead to the following consequences (Lodderstedt et al., 2013):

• Persistent unauthorized access: The attacker can continuously obtain new access tokens and remain authenticated as the legitimate user of the compromised account for an extended period.
• Long-term data exposure: Sensitive user or system data can be accessed repeatedly over time without detection.
• Privilege abuse over time: A persistent authenticated session allows the attacker to repeatedly perform actions and access resources associated with the compromised account.
• Difficulty in detection and revocation: New access tokens can be continuously issued using the compromised refresh token, allowing the attacker to remain authenticated without requiring a new login. As a result, malicious activity may appear to be legitimate user behavior, making the compromised session more difficult to identify.

One approach to address this compromise is to implement token lifecycle management with security mechanisms such as refresh token rotation and refresh token reuse detection.

Mitigations

The refresh token rotation mechanism enhances security by issuing a new refresh token every time the client requests a new access token. Once a refresh token is used, it is immediately invalidated. Without this mechanism, a stolen refresh token could be used repeatedly without raising suspicion, which makes it very hard to detect a compromise. This ensures that only the most recent token is valid, enabling the authentication system to distinguish normal sequential use from suspicious behavior.

In addition, reuse detection actively detects attempts to use invalidated tokens. If the system receives an older token that has already been invalidated through rotation, this strongly indicates that the refresh token has been compromised. In response, the system immediately revokes the affected session, thereby blocking further access and protecting the account (Serverion, 2025). Together, these mechanisms significantly enhance security by detecting suspicious activity and preventing unauthorized access while maintaining a seamless experience for legitimate users.

Refresh token rotation and reuse detection offer strong protection against token theft without disrupting the user experience. A legitimate user will only notice these security mechanisms if a reuse event is detected, which ends their current session and requires them to log in again.  As these events are rare for typical users, this improves security while preserving usability.

Conclusion

Token security cannot be judged by token format alone. While the structure and integrity of a token matter, the real security of a token-based system depends on how tokens are managed after issuance. Mechanisms such as token expiration, refresh token rotation, and reuse detection are not optional enhancements but essential safeguards against session hijacking and persistent unauthorized access. In practice, secure token management is what determines whether token-based authentication remains resilient in real-world use.

Writer’s thesis in Theseus: URN:NBN:fi:amk-2026060422092

References

Hardt, D. (2012). The OAuth 2.0 authorization framework (RFC 6749). Internet Engineering Task Force. https://doi.org/10.17487/RFC6749

Lodderstedt, T., McGloin, M., & Hunt, P. (2013). OAuth 2.0 threat model and security considerations (RFC 6819). Internet Engineering Task Force. https://doi.org/10.17487/RFC6819

Serverion. (2025, December 4). Refresh token rotation: Best practices for developers. https://www.serverion.com/uncategorized/refresh-token-rotation-best-practices-for-developers/

Image source: https://www.loginradius.com/assets/blog/identity/oidc-authentication-security/token-lifecycle.webp