Intermediate LevelREST APIs & Web Services
How do Refresh Token Rotation and Sliding Sessions maintain secure login state?
❓ Interview Prompt: Explain short-lived Access Tokens (15m), long-lived Refresh Tokens (7d), Refresh Token Rotation, detecting token reuse, and security.
Combining security with smooth user sessions uses short-lived Access Tokens and long-lived Refresh Tokens:
Refresh Token Rotation Pattern:
1
API issues short-lived Access Token (15 mins) and single-use Refresh Token (7 days).
2
When Access Token expires, client requests new tokens by submitting Refresh Token.
3
Server invalidates old Refresh Token and issues a brand new Refresh Token + Access Token pair.
4
Breach Detection: If an attacker attempts to reuse an old, already-exchanged Refresh Token, the server detects token theft and immediately revokes the ENTIRE family of refresh tokens for that user!
Code Implementation Example
typescript
export async function refreshTokens(oldRefreshToken: string) {
const session = await db.session.findByToken(oldRefreshToken);
if (!session || session.isUsed) {
// Reuse detected! Compromised! Revoke all user sessions!
await db.session.deleteMany({ where: { userId: session?.userId } });
throw new Error('Security Breach: Token Reuse Detected');
}
// Mark used and issue new pair...
}💡Detecting refresh token reuse breaches and revoking user session families.
🎯 Interview Key Takeaway
Use Refresh Token Rotation to keep access tokens short-lived while automatically detecting token theft attempts.
#Refresh Tokens#Rotation#Security#Intermediate
Back to all REST APIs & Web Services Questions→