I'm using Google OAuth 2.0 to provide logins to my site(a rinkydink internal tool for other devs at my company to use, so security isn't paramount, but there are a few access restrictions) However, once logged in, I don't need to access any additional Google resources -- I just get the user email and consider the user logged in. How is this typically done? The options I see are...

A. Store this login in a cookie and never contact Google again (at least until the cookie times out or the user logs out manually)

B. Have a long-term cookie storing a key (the server stores the OAuth code), and re-authenticate when the user wants to do a sensitive action.

C. Have a long-term cookie storing a key (the server stores the OAuth code), and a short-term session cookie that expires when they close their browser. Whenever they first access the page, I re-authenticate once and give them this session cookie.

  • Either B or C, it kind of depends on how often users login, how sensitive the data is and so on. Personally I'd go with C. Remeber that some access tokens are valid longer than sessions, so you need to define 'long' and 'short'. Aug 25 '16 at 9:08

Typically with Token Based Authentication you have two types of tokens:

Access Tokens

These are the tokens passed to actually request access to resources. They are short lived.

Refresh Tokens

These are tokens used to get a new access token once it expires. These have long expiration times and are stored securely on a system.

The idea behind this,is that Access Tokens will be used to grant you access to resources. They expire in a short time, so if compromised, access to the system is limited. Refresh Tokens only need to be used when you need a new Access Token, so don't travel over the wire constantly. The emphasis on storing Refresh Tokens securely.

Session Management

There is two method that can be used to store Tokens, Web Storage and Cookies. Of the two, my current preference is with Cookies with the flags HttpOnly and Secure set.


I would recommend taking the same approach you would take if you weren't using a third party for authentication: once the session expires, reauthenticate.

Once the user is authenticated there's really no reason to contact google again. You don't even need to store the access_token after you used it to access the resources you needed for authentication.

This way, the only parameter you need to worry about is how long should the session last. It will depend on you security requirements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.