.tip

A stolen token that is valid for a month is a month of access. One that expires in fifteen minutes is fifteen minutes, and the refresh token that gets a new one is rotated on every use so a stolen refresh token is caught on the second use.

access:  15 min, in memory, sent as Bearer
refresh: 14 days, HttpOnly cookie, rotated on each refresh, family revoked on reuse

Reuse of an old refresh token means both parties have it. Revoke the whole family and make the user log in.