OAuth 2.0 Refresh Token Rotation and Concurrent Request Limits

Implementing Refresh Token Rotation is a common security measure to mitigate the risk of token theft by issuing a new refresh token with every access token renewal. However, this mechanism introduces complexity when handling concurrent requests in high-latency environments or distributed systems.

When multiple asynchronous requests attempt to use the same refresh token simultaneously, the authorization server may trigger reuse detection. According to standard security patterns, reuse detection typically results in the immediate revocation of the entire token family to protect the user session.

There is uncertainty regarding the optimal configuration for a grace period that allows for network retry overlap without compromising the security benefits of rotation.

• What are the industry-standard limits for the reuse detection grace period to prevent accidental session revocation during concurrent refreshes?
• How can a system distinguish between a legitimate race condition and a malicious token reuse attempt during this window?