I Spent 3 Days Implementing 'Login with Google' (OAuth 2.0 Deep Dive)

8. Advanced: Refresh Token Rotation

When the Access Token expires (usually after 1 hour), the user gets logged out. To prevent this, we use a Refresh Token. But if a Refresh Token is stolen, the hacker has permanent access.

Solution: Refresh Token Rotation.

1. When you use a Refresh Token to get a new Access Token, the server also issues a NEW Refresh Token.
2. The OLD Refresh Token is immediately invalidated.
3. If a hacker tries to reuse the old Refresh Token, the server detects "Reuse Detection" and invalidates the entire session family (logging out both the victim and the hacker).

NextAuth.js and Supabase Auth handle this complex logic automatically. This is yet another reason why you should not build OAuth from scratch unless you enjoy reading IETF RFC documents for fun.