Good decision to rely on Google/Facebook for user authentication.
I think it really depends on what sort of information will be exchanged between your system and the intended users. Should it be kept private?
As a general rule, it’s best to use SSL when publishing a site that supports user accounts and set the authentication cookie to 'secure' (browser only sends it with https). This makes it much harder to hijack user sessions by a man-in-the-middle - because the cookie will be encrypted.
When you login through Google/Facebook the url you are redirected to is off-course https, but after your users are authenticated it is up to your site to generate a session cookie and maintain user sessions.