From RFC 6749 (section 10.4):
The authorization server MUST ensure that refresh tokens cannot be generated, modified, or guessed to produce valid refresh tokens by unauthorized parties.
I don't understand why this is necessary since when the client wants to obtain an access token using the
refresh_token grant type, it MUST send a client ID and a secret key in the body of the request, otherwise the request is denied by the authorization server. Unauthorized party would have to somehow acquire the client ID and the secret key.