> If a token is compromised then that will create a problem for that single request because the next token will be different and will be using a new key for enc

> If a token is compromised then that will create a problem for that single request because the next token will be different and will be using a new key for encryption. I don’t follow. What stops a user from replaying any token/request? Request 1: User sends credentials. Response 1: Server sends session token encrypted using server’s private key. Request 2: User sends token from response 1. Response 2: Server sends a new token, encrypted using server’s private key. Request 3: User sends token from response 2. What stops the user from using the token in response 1 multiple times? How does it become invalid?