6 / 8 Authentication: Sessions, JWT & OAuth

Rotation Buys Detection

A single-page app keeps its refresh token in localStorage. An XSS bug lets an attacker read it. The team responds by turning on refresh token rotation with reuse detection: each redemption returns a new refresh token and invalidates the old one, and presenting an already-redeemed token revokes the whole token family. What does that actually change about this incident?

A

Only the exposure window shrinks. Rotation shortens the refresh token's life to the rotation interval, so the attacker loses access at the next rotation while the real session continues.

B

The theft still succeeds and the attacker can redeem the token once. What rotation adds is detection: whichever party redeems second presents a retired token, and the authorization server kills the family for both of them.

C

The stolen token stops working immediately, because rotation re-encrypts the outstanding token under a per-session key the attacker never saw.

D

The theft is prevented, because a rotated refresh token is bound to the TLS connection that requested it and cannot be replayed from another client.