I don't really understand at all the protection scenario when a refresh token is stolen. Please explain.
Let's say there is this situation: the user is authorized in a mobile app and this app contains two tokens - a short-living access token and a long-living refresh token. Now, the attacker somehow steals both tokens from the user's device and immediately uses the refresh token to get a new pair of tokens, making the old tokens invalid. After that, when the user tries to use his old refresh token it will be invalid, and he will have to login again using his password.
At this point, the server should invalidate all other refresh tokens to prevent further usage by an attacker. But how then to implement multiple device authorization for one user, if there is only one refresh token available at a single time?