I have a scenario where a user has a refresh token. As that token is getting ready to expire, the client sends the refresh token to the auth server to get a new refresh token. This usually happens on mobile devices and sometimes the response is not received - the connection is dropped or the browser is closed.
At this time, the user still has the old refresh token which is getting ready to expire.
Also, since the auth server has issued a new token, the auth server gives the client 5 minutes to retry, and then revokes the old token if it hasn't heard anything.
When the user opens his browser up again, he finds that he is logged out because he did not receive the new token, and the old token has been revoked.
Obviously to fix this, I could not revoke the old token, or give it more time like 24 hours before it's revoked. Is there any security risk in doing this? It means that there are two refresh tokens, but I guess if the refresh tokens can only be used with the auth server, then the auth server could revoke the other if either are used to try to get a new refresh token. Is that normal?