リフレッシュトークンをローテーションすると、並行リクエストでログアウトされることがある

let r = await send(accessToken);
if (r.status === 401) {
  await refresh();           // 並行する 401 がすべてここに来る
  r = await send(accessToken);
}

naive: every 401 refreshes       | burst: ERR,200,ERR | POST /token: 3 | after next expiry: ERR (refresh failed: 400)

let inflight = null;
const refreshOnce = () =>
  (inflight ??= doRefresh().finally(() => { inflight = null; }));

if (state.access !== tokenThatFailed) return;   // 他の誰かがすでに更新した

// Refresh-token rotation vs. concurrent 401s.   Run: node refresh_demo.mjs   (Node >= 18, no dependencies)
import http from 'node:http';

// ---- A toy authorization/resource server: rotation + reuse detection (+ optional grace window) ----
function makeServer({ graceMs = 0 } = {}) {
  const s = { seq: 0, access: new Set(), refresh: new Map(), used: new Map(), revoked: new Set(), tokenCalls: 0 };
  const issue = (family) => {
    const n = ++s.seq;
    s.access.add(`a${n}`);
    s.refresh.set(`r${n}`, family);
    return { access: `a${n}`, refresh: `r${n}` };
  };
  s.first = () => { const t = issue('family-1'); s.access.delete(t.access); return t; }; // access token starts out expired
  const srv = http.createServer((req, res) => {
    let body = '';
    req.on('data', (d) => (body += d));
    req.on('end', async () => {
      await new Promise((r) => setTimeout(r, Number(req.headers['x-delay'] ?? 20)));      // network + processing
      if (req.url === '/api') {
        const token = (req.headers.authorization ?? '').replace('Bearer ', '');
        res.statusCode = s.access.has(token) ? 200 : 401;
        return res.end('{}');
      }
      s.tokenCalls++;                                                                       // POST /token
      const { refresh } = JSON.parse(body);
      const family = s.refresh.get(refresh);
      if (family && !s.revoked.has(family)) {                                               // normal rotation
        s.refresh.delete(refresh);
        s.used.set(refresh, { family, at: Date.now() });
        return res.end(JSON.stringify(issue(family)));
      }
      const old = s.used.get(refresh);
      if (old && Date.now() - old.at < graceMs && !s.revoked.has(old.family)) {            // grace window
        return res.end(JSON.stringify(issue(old.family)));
      }
      if (old) s.revoked.add(old.family);                                                   // reuse detected: revoke everything
      res.statusCode = 400;
      res.end('{"error":"invalid_grant"}');
    });
  });
  s.listen = () => new Promise((ok) => srv.listen(0, '127.0.0.1', () => { s.url = `http://127.0.0.1:${srv.address().port}`; ok(); }));
  s.close = () => srv.close();
  return s;
}

// ---- The client under test: three ways to react to a 401 ----
function makeClient(server, strategy, tokens) {
  const state = { ...tokens };      // { access, refresh }
  let inflight = null;              // the one refresh currently running, if any

  async function doRefresh() {
    const r = await fetch(server.url + '/token', { method: 'POST', body: JSON.stringify({ refresh: state.refresh }) });
    if (!r.ok) throw new Error('refresh failed: ' + r.status);
    Object.assign(state, await r.json());          // access AND refresh token are replaced together
  }

  function refresh(tokenThatFailed) {
    if (strategy === 'naive') return doRefresh();                                  // every 401 refreshes
    if (strategy === 'single-flight+stale-check' && state.access !== tokenThatFailed)
      return Promise.resolve();                                                    // someone already renewed it
    return (inflight ??= doRefresh().finally(() => { inflight = null; }));         // join the refresh in progress
  }

  return {
    state,
    async call(delay = 20) {
      const send = (token) => fetch(server.url + '/api', { headers: { authorization: 'Bearer ' + token, 'x-delay': String(delay) } });
      const used = state.access;
      let r = await send(used);
      if (r.status !== 401) return r.status;
      await refresh(used);                         // may throw
      return (await send(state.access)).status;    // retry exactly once
    },
  };
}

async function scenario(title, strategy, opts) {
  const server = makeServer(opts); await server.listen();
  const client = makeClient(server, strategy, server.first());
  // three requests start with the expired token; the third is slow, so its 401 arrives after the refresh finished
  const results = await Promise.allSettled([client.call(), client.call(), client.call(150)]);
  const burst = results.map((r) => (r.status === 'fulfilled' ? r.value : 'ERR')).join(',');
  const tokenCalls = server.tokenCalls;
  server.access.clear();                           // later, the new access token expires too
  const next = await client.call().then(String, (e) => `ERR (${e.message})`);
  console.log(`${title.padEnd(32)} | burst: ${burst.padEnd(11)} | POST /token: ${tokenCalls} | after next expiry: ${next}`);
  server.close();
}

await scenario('naive: every 401 refreshes', 'naive');
await scenario('naive + 2 s server grace window', 'naive', { graceMs: 2000 });
await scenario('single-flight', 'single-flight');
await scenario('single-flight + stale check', 'single-flight+stale-check');

naive: every 401 refreshes       | burst: ERR,200,ERR | POST /token: 3 | after next expiry: ERR (refresh failed: 400)
naive + 2 s server grace window  | burst: 200,200,200 | POST /token: 3 | after next expiry: 200
single-flight                    | burst: 200,200,200 | POST /token: 2 | after next expiry: 200
single-flight + stale check      | burst: 200,200,200 | POST /token: 1 | after next expiry: 200