Detecting a stolen refresh token
Refresh tokens are rotated: every refresh returns a new one and the old is invalidated. That limits how long a stolen token stays useful.
It doesn't detect the theft. The server deletes the old token on rotation, so when the attacker's copy shows up it looks like any other unrecognised value — indistinguishable from an expired one, or a typo.
Change what the server keeps, so a replay is recognisable.
Components — tap one, then tap a slot on the diagram
!A stolen refresh token was used and the server could not tell it apart from an expired one.
Outside every boundary: The session, Whoever stole it (same token; FAILED: replaying), The real client, an empty slot for the what the server retains Connections: The real client calls what the server retains — rotates normally (step 1) Whoever stole it calls what the server retains — presents a used one (step 2) what the server retains controls The session — revoke everything (step 3)
The session
Whoever stole itsame tokenreplaying
The real client