You are probably familiar with a document called OAuth Threat model. In that document, refresh token rotation is preferred, but it also addresses the obvious d

You are probably familiar with a document called OAuth Threat model. In that document, refresh token rotation is preferred, but it also addresses the obvious difficulty in clustered environments: https://datatracker.ietf.org/doc/html/rfc6819#section-5.2.2.3 https://datatracker.ietf.org/doc/html/rfc6819#section-5.2.2....