I'm using Google OAuth 2.0 to provide logins to my site(a rinkydink internal tool for other devs at my company to use, so security isn't paramount, but there are a few access restrictions) However, once logged in, I don't need to access any additional Google resources -- I just get the user email and consider the user logged in. How is this typically done? The options I see are...
A. Store this login in a cookie and never contact Google again (at least until the cookie times out or the user logs out manually)
B. Have a long-term cookie storing a key (the server stores the OAuth code), and re-authenticate when the user wants to do a sensitive action.
C. Have a long-term cookie storing a key (the server stores the OAuth code), and a short-term session cookie that expires when they close their browser. Whenever they first access the page, I re-authenticate once and give them this session cookie.