What happens if a refresh token is stolen and the user doesn't try to refresh until it expires?
I'm trying to understand what happens if a refresh token gets stolen and the real user doesn't attempt to refresh it until after the token expires. Let's say…