# OAuth2 刷新令牌重放检测：相同的刷新令牌被多次使用

- **ID:** `security/oauth2-token-replay-via-refresh-token`
- **领域:** security
- **类别:** auth_error
- **错误码:** `invalid_grant`
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

OAuth2 刷新令牌在每次使用后未轮换，导致窃取令牌的攻击者可以无限重放以获取新的访问令牌。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| OAuth 2.0 RFC 6749 | active | — | — |
| Spring Security OAuth2 2.5.x | active | — | — |
| Keycloak 21.0.x | active | — | — |
| Auth0 Node.js SDK 2.0.0 | active | — | — |
| Okta .NET SDK 3.0.0 | active | — | — |

## 解决方案

1. ```
   Implement refresh token rotation: issue a new refresh token with each access token refresh and invalidate the old one. Example: In Spring Security OAuth2, set `refreshTokenRotationEnabled=true` in authorization server config.
   ```
2. ```
   Use refresh token expiration with a short TTL (e.g., 15 minutes) combined with rotation, and require re-authentication after expiry.
   ```
3. ```
   Add a client-side nonce or binding to refresh token to tie it to a specific device or session, preventing cross-device replay.
   ```

## 无效尝试

- **** — Longer expiration gives attackers more time to exploit stolen tokens; does not address the fundamental replay vulnerability. (95% 失败率)
- **** — Blacklists are hard to maintain in distributed systems and require real-time synchronization; attackers can still replay before blacklisting. (70% 失败率)
- **** — Rate limiting may block legitimate users and does not prevent a single replay attack; attacker can still use the token once before rate limit kicks in. (85% 失败率)