Should an oAuth server give the same accessToken to a same client request? : <p>I am developing an oAuth2 server and I've stumbled upon this question.</p>

<p>Lets suppose a scenario where my tokens are set to expire within one hour. On this timeframe, some client goes through the implicit auth fifty times using the same <code>client_id</code> and same <code>redirect_uri</code>. Basically same everything.</p>

<p>Should I give it the same <code>accessToken</code> generated on the first request on the subsequent ones until it expires or should I issue a new <code>accessToken</code> on every request?</p>

<p>The benefits of sending the same token is that I won't leave stale and unused tokens of a client on the server, minimizing the window for an attacker trying to guess a valid token.</p>

<p>I know that I should rate-limit things and I am doing it, but in the case of a large botnet attack from thousands of different machines, some limits won't take effect immediately.</p>

<p>However, I am not sure about the downsides of this solution and that's why I came here. Is it a valid solution?</p>
