guidance on rotating refreshing tokens and dealing with

[dickhardt]

we should provide guidance on the impact of a refresh that fails where the old refresh token is now invalid but the new refresh token did not get to the client because of an error along the way

[surbas]

Appreciated this one. Depending on the oauth2 provider we sometimes lose up to 1% of active connections in a day, which means for us somebodies automated workflow breaking down and requiring re-authentication.... which is annoying. With some, we have been able to convinced them, that if they value resiliency more then the incremental secure gain, that they should allow more then one (2 or 3) refresh token to be valid. This is not as secure (by some amount), but the trade off is the connection is more resilient. Having some guidance in the spec around this discussion would help tremendously to at least start to having these conversations. Let me know how I can help!

[brockallen]

I think there was already guidance that one-time use refresh tokens are not really ideal, and don't provide the security benefits originally thought. Perhaps it was in the browser-based apps BCP (BFF) doc?