---
title: "Discussion on \"JWT + Role-Based Access in Spring Security: Refresh Tokens Without the Footguns\" | Hashnode"
description: "Discussion on \"JWT + Role-Based Access in Spring Security: Refresh Tokens Without the Footguns\". Rotation with reuse detection, ROLE_ vs SCOPE_ mapping, and the permitAll() trap, all tested on Spring Boot 4.1.2. Replaying an old refresh token revoked 2 tokens and killed the session."
url: "https://hashnode.com/posts/spring-security-jwt-refresh-token-rotation-rbac/6af29fea91696569429d27db"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [JWT + Role-Based Access in Spring Security: Refresh Tokens Without the Footguns](https://gowthammuthuvel.hashnode.dev/spring-security-jwt-refresh-token-rotation-rbac?utm_source=hashnode&utm_medium=feed)

Rotation with reuse detection, ROLE\_ vs SCOPE\_ mapping, and the permitAll() trap, all tested on Spring Boot 4.1.2. Replaying an old refresh token revoked 2 tokens and killed the session.

8h ago · 20 min read · gowthammuthuvel.hashnode.dev  
Read the article

-   [#spring-security](https://hashnode.com/tag/spring-security)
-   [#jwt](https://hashnode.com/tag/jwt)
-   [#spring-boot](https://hashnode.com/tag/spring-boot)
-   [#java](https://hashnode.com/tag/java)
-   [#backend](https://hashnode.com/tag/backend)

## Written by

[Gowtham Muthuvel](https://hashnode.com/@GowthamMuthuvel)

@GowthamMuthuvel

  
[View profile](https://hashnode.com/@GowthamMuthuvel)

Full-stack developer | Java, Spring Boot, React | Senior Backend Developer

## Responses

Markdown supported · ⌘↵ to post

No responses yet.