title: How do I implement Refresh Token Rotation?
body: <p>If I understood the refresh token rotation right, it means that every time we request a new access token, we also get a new refresh token. If a refresh token is used more than once - we invalidate all the refresh tokens that a certain user previously used, and a user has to go through the authentication process again.</p>
  <ol>
  <li><p>Does it mean that we need to store all the refresh tokens (all the old ones) in a database?</p>
  </li>
  <li><p>Can't we simply store the last refresh token, only one (that wasn't used yet), and with each request to get a new access token we would check if the refresh token sent in the request is in the database, and if so, we would create a new access and refresh token and overwrite the old refresh token in the database, so that old refresh tokens can't be used to get new tokens?</p>
  </li>
  <li><p>How long should such refresh tokens live?</p>
  </li>
  </ol>