If your refresh token gets stolen, rotation alone won't save you — here's what does

Standard advice for refresh tokens is pretty straightforward: rotate on every use store them hashed keep expiry short Done, right? Not quite. Rotation alone does nothing against token theft. If malware or XSS lifts a refresh token from a legit client, the attacker and the client effectively race to rotate it. whoever loses the race gets a "token revoked" error whoever wins keeps the session alive From the server’s point of view, it just sees two valid requests seconds apart. No alarm. No signal.