How to implement Refresh Tokens with some security?
<p>Each time a user logins, he get a new <code>access_token</code> and a new <code>refresh_token</code>.</p>
<p>When his <code>access_token</code> is expired, he uses his <code>refresh_token</code> to get a new <code>access_token</code>.</p>
<p>If an attacker somehow gets access to his <code>refresh_token</code>... then according to Oauth 2.0 <a href="https://www.rfc-editor.org/rfc/rfc6749#section-10.4" rel="nofollow noreferrer">documentation</a> :</p>
<blockquote>
<p>The authorization server could employ refresh token
rotation in which a new refresh token is issued with every access
token refresh response.  The previous refresh token is invalidated but
retained by the authorization server.  If a refresh token is
compromised and subsequently used by both the attacker and the
legitimate client, one of them will present an invalidated refresh
token, which will inform the authorization server of the breach.</p>
</blockquote>
<p>So basically, if any <code>refresh_token</code> is used twice, I will notice the attack.</p>
<p>But what about if the legitimate user never uses his refresh token (which was stolen by an attacker) ? The attacker will be able to login and refresh over and over without the legitimate user being able to detect it.</p>
<p>Sounds like a rare situation ? What if you come to my place for a dinner and login with my computer and I get your refresh_token and access_token and you will never use this refresh_token again? Nobody will ever notice the attack.</p>
<p>What could solve this ?</p>