OAuth2刷新令牌轮换失败：检测到刷新令牌重用

解决方案

1. Implement refresh token rotation correctly: after each successful refresh, discard the old refresh token and store the new one. Example in a Node.js OAuth2 client:
   
   async function refreshAccessToken(refreshToken) {
     const response = await fetch('https://auth.example.com/token', {
       method: 'POST',
       headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
       body: new URLSearchParams({
         grant_type: 'refresh_token',
         refresh_token: refreshToken,
         client_id: 'your-client-id',
         client_secret: 'your-client-secret'
       })
     });
     const data = await response.json();
     if (data.refresh_token) {
       // Securely store the new refresh token
       await storeRefreshToken(data.refresh_token);
     }
     return data.access_token;
   }

2. Use short-lived refresh tokens and implement a fallback to the authorization code flow if refresh fails. For example, in Auth0:
   
   const client = new OAuth2Client({
     clientId: 'your-client-id',
     authorizationUri: 'https://auth.example.com/authorize',
     tokenUri: 'https://auth.example.com/token',
     redirectUri: 'https://app.example.com/callback',
     usePKCE: true,
     refreshTokenRotation: true
   });
   try {
     const token = await client.refreshToken(oldRefreshToken);
   } catch (error) {
     if (error.message.includes('refresh token reuse')) {
       // Redirect user to login again
       window.location.href = '/login';
     }
   }

3. If using Keycloak, configure refresh token revocation on reuse in the realm settings:
   
   Keycloak Admin Console -> Realm Settings -> Tokens -> 'Revoke Refresh Token' = ON
   
   This ensures that any reuse triggers immediate revocation.