What this test does
After reusing an old refresh token, checks whether the newest tokens still work.
How it passes
The newest tokens are revoked too. Skipped without a userinfo endpoint.
- Specification
- RFC 9700 §4.14.2
- Needs
- S504 Old refresh tokens stop working after rotation