Why Refresh Token Rotation Falls Short

Refresh token rotation is standard security advice, but it's fundamentally inadequate against token theft—when attackers steal a token, they race the legitimate client to rotate it, and the server has no way to detect which request is malicious. The critical missing piece is refresh token reuse detection (OAuth 2.0 Security BCP §4.14), which identifies when a previously rotated token reappears as evidence of compromise and invalidates the entire token family, catching attacks that rotation alone silently misses.