Sessionless refresh tokens: JWT rotation in 80 lines

Pure stateless JWT has a famous problem: you cannot revoke it. The middle ground I use: a short access token (15 min), fully stateless, plus an opaque refresh token, persisted and rotated on every use.

undefined

The detail almost no one implements: reuse detection. If an already-used refresh token shows up again, someone stole it — revoking the whole family logs out the attacker and the legit user, who simply logs in again.