A refresh token tree is maintained on the backend, but you still need to synchronise the frontend to do only one refresh at a time. Otherwise you can get a false positive of token theft.