.tip

A stolen token that's valid for a month is a month of access. One that expires in fifteen minutes is fifteen minutes. The refresh token that gets a new one is rotated on every use, so a stolen refresh token gets caught the second time it's used.

access:  15 min, in memory, sent as Bearer
refresh: 14 days, HttpOnly cookie, rotated on each refresh, family revoked on reuse

If an old refresh token comes back, two parties have it. Revoke the whole family and make the user log in again.