RefreshTokenService

Refresh tokens, explained simply:

• Think of a refresh token as a long-lived “session receipt” stored in an HttpOnly cookie.

• Every time you use it, we swap it for a brand new one (so an old one can’t be reused).

• If an old token shows up again, we assume it was stolen and shut down the whole session family.

This in-memory implementation is perfect for dev/single-node. Use Redis/DB for production.

Key ideas:

• Each refresh token belongs to a family (one login session) and is bound to a DPoP key thumbprint (jkt).

• Rotate-on-use and reuse detection keep sessions safe.