Node.js · Authentication · Mid-Level · Architecture
Implementing refresh token rotation — key points?
Short Interview Answer
Short-lived access tokens, rotating refresh tokens, detect reuse (theft), store hashed refresh tokens server-side.
Detailed Explanation
Reuse detection should revoke the family. Transmit securely. Prefer opaque refresh tokens over fat JWTs for refresh.