How to protect yourself from the fact that an attacker steals a refresh token?

Question

User identification

Refresh token is stored in http only cookie. I saw a recommendation to store the refresh token in the database and compare it for equivalence with the token stored in the cookie, but in this case, what if the user, being authorized on one device, logs in on another?

Answer 1

Refresh token binding to :
1. fingerprint (device id; + refresh token binding)
2. IP/Subnet (+ refresh token binding)
3. Behavioral factor control

what to do if the user, being authorized on one device, logs in on another?

I already answered here and I will repeat:
Account-> Device-> Token and nothing else!
And, as Pardon Me! Where Do I Find 4giveness? , the refresh token must be changed several times per user session (activity) in a completely "transparent" (to the user) mode.

Answer 2

The meaning of the refresh token is that if it is stolen, the user will automatically log out at the next refresh and notice this fact. That is, an attacker can harm, but secretly harm and go unnoticed - no.