| ▲ | theonething 6 days ago | ||||||||||||||||
> invalidating refresh keys after single use That's called refresh token rotation and is a valid security practice. | |||||||||||||||||
| ▲ | another_twist 6 days ago | parent [-] | ||||||||||||||||
I know but the RFC doesnt mandate it. https://datatracker.ietf.org/doc/html/rfc6749#section-6 Not sure why Google doesnt do this but Atlassian does. | |||||||||||||||||
| |||||||||||||||||