Rotating refresh token

[oharsta]

See https://www.rfc-editor.org/rfc/rfc6749#section-10.4 and the behaviour supported by Okta: https://developer.okta.com/docs/guides/refresh-tokens/main/#refresh-token-rotation

[baszoetekouw]

The spec says (section 10.4):

The authorization server MUST verify the binding between the refresh
token and client identity whenever the client identity can be
authenticated. When client authentication is not possible, the
authorization server SHOULD deploy other means to detect refresh
token abuse.

For example, the authorization server could employ refresh token
rotation in which a new refresh token is issued with every access
token refresh response.

I read that to mean: "If the client does not reissue refresh tokens on use, the server SHOULD deploy other means to detect refresh token abuse". So we can only implement static refresh tokens IF we have other means to detect abuse.