Refresh tokens are rotated on use

Refresh tokens that can be reused indefinitely negate the security benefit of short-lived access tokens entirely. CWE-384 (Session Fixation) captures the structural problem: a compromised token remains valid forever as a fixed key to the account. OWASP API2 (Broken Authentication) specifically calls out refresh token replay as an authentication weakness. A single leaked refresh token — from a log, a compromised client, or a man-in-the-middle — gives an attacker persistent access that survives every access token expiry. Rotation with detection forces the attacker to race the legitimate user, and a race loss invalidates the entire session.

Treat each refresh token as single-use: when it's consumed to issue a new access token, delete the old one from the database and persist the replacement. Detect replay attacks by flagging token reuse.

// src/app/api/auth/refresh/route.ts
export async function POST(req: Request) {
  const { refreshToken } = await req.json()
  const stored = await db.refreshToken.findUnique({ where: { token: refreshToken } })

  if (!stored) {
    // Token not found — could be a replay attack; invalidate all sessions for safety
    return new Response('Unauthorized', { status: 401 })
  }

  // Delete old token before issuing new one (rotation)
  await db.refreshToken.delete({ where: { id: stored.id } })

  const newRefreshToken = crypto.randomUUID()
  await db.refreshToken.create({
    data: { token: newRefreshToken, userId: stored.userId, expiresAt: addDays(new Date(), 30) }
  })

  return Response.json({
    accessToken: signAccessToken(stored.userId),
    refreshToken: newRefreshToken
  })
}