The original headline is: "Four Ways a Refresh Token Request Fails — Only One Means Trouble"

Short summary

This article walks through four failure modes for a single-use refresh token rotation system built with NestJS and TypeORM, explaining that three are routine (invalid, expired, or revoked tokens) while the fourth — token reuse — triggers family-wide revocation. The author demonstrates with code and curl examples how detecting a reused token kills every descendant token in the same session family, including the legitimate client's current token. The blast radius is confirmed to be scoped per-family, leaving other users' sessions untouched.

• •Single-use refresh tokens grouped by familyId enable detection of token theft via reuse
• •Reusing a consumed token revokes the entire family chain, not just the reused token
• •Blast radius is correctly scoped: other users' independent families remain unaffected

Generated with AI, which can make mistakes.