I am considering moving my SPA from Implicit flow to Authorization Code + PKCE extension.
This new flow will provide the SPA with a Refresh Token that doesn't expire.
Let's say a malicious user on the computer/browser manages to get hold of the Refresh Token from the browser.
What are the remediations I need to set-up on the IdP and other systems to impersonate my SPA and indefinitely exchange the Refresh token for a new pair of Access Token and Refresh Token?
I've looked around and have found no clear explanation on this matter.