According to 4.14.2 in OAuth 2.0 Security Best Current Practice, OAuth servers should “Refresh token rotation: the authorization server issues a new refresh token with every access token refresh response.” However Google only issues one refresh token after the client consent is granted, and none with each access token. Why is this?
1 Like