> If an attacker steals a session cookie with XSS or session fixation, the attacker immediately gains access to a valid session and can keep performing requests

> If an attacker steals a session cookie with XSS or session fixation, the attacker immediately gains access to a valid session and can keep performing requests to keep the session alive. Objectively false? If they get the refresh token sure, but even that has an expiration and isn't refreshable in many common implementations. If they only get the access token, then this is completely false; you can't refresh a session using only the access token.