Multiple ChoiceIntermediate 45s
Refresh token rotation security
You implement OAuth2 refresh tokens. Which practice detects token theft?
Options
- 1Rotate the refresh token on each use and revoke the family if a reused token appears
- 2Issue refresh tokens that never expire and are never rotated after their first use
- 3Store the refresh tokens in URLs so they travel with every outbound API request
- 4Allow a refresh token to be reused an unlimited number of times without rotation
Think you can answer under pressure?
Get matched and answer live questions in 3-minute 1v1 battles. Elo ranking, badge tiers and bragging rights on the line.