title: Where to store refresh token safely
body: <p>This <a href="https://stackoverflow.com/questions/32620689/where-to-store-access-token-and-refresh-token-in-oauth-2-0">where to store - access token and refresh token in OAuth 2.0</a> is the answer I was looking for but I have something that's not clear to me or maybe I'm just overthinking it.</p>
  
  <p>Let's say I have a website X that calls a REST api and stores the refresh token in the browser as an HttpOnly cookie. If a malicious man M gets into some other guys computer that's already logged in X as U, M can go and look for the cookie and steal that refresh token. Then M will be able to retrieve all the tokens he wants for U, he will just need the client Id and client secret of that application, which he can get from any other user of the application, for example he himself M by just looking at the value of the header when a GET new access token call is made. Is that correct ?</p>