title: How is a refresh token more secure than a long lived JWT?
body: <p>I'm having a hard time understanding the use of refresh tokens when using JWT's with naturally insecure clients (browsers, mobile phones, etc.).</p>
  
  <p>To me, it seems naive to think that if a JWT has been compromised the refresh token has not also been compromised.</p>
  
  <p>The attacker essentially has a source of unlimited JWT's as long as the refresh token remains valid. Even if you invalidate used refresh tokens the attacker still has the upper hand if they implement a slightly more aggressive refresh policy. How is this different from a compromised long-lived JWT?</p>
  
  <p>When using a long-lived JWT the attacker can only continue getting valid JWT's if they have the ability to continuously exploit whatever vulnerability gave them the JWT in the first place. With refresh tokens, they can get the JWT through a vulnerability once and then get new JWT's with impunity however they like. This seems either equally secure or perhaps even less secure than long-lived JWT's.</p>
  
  <p>What am I missing?</p>