服务器端oauth：如何处理收到的令牌

Question

This is my first time doing a full implementation of server side OAuth (as described here https://developers.google.com/identity/protocols/OAuth2WebServer) and I am getting a bit confused as to what to do with the tokens after receiving them from the auth provider. I can see a few options

1. Send it to the user for local storage and send it to the db. have the frontend send it in http headers on every request and compare it with the one in the db to authenticate.

2. Send it to the database and work out some other form of authentication through a jwt or cookie.

3. something else?

1 would be my preferred way, but something feels wrong about it...IDK what, while 2 feels a little wasteful because I will have to come up with an entirely different auth mechanism and then just pull the token from the db and refresh and use it as normal anyway...

What is an acceptable flow for this part of the application?

Answer 1

First, you should decide which part of your application will have a role of the OAuth2 client. If you have a React SPA as a frontend, I would suggest you to make it the client and use the Implicit grant OAuth2 flow (designed for browser apps) instead of the Auth code grant. This way, the SPA initiates the authentication and it receives an ID token (to identify the user) and an access token to call Google services.

Then there is a question how to identify a user at the backend. I would use the ID token for that - the backend will have to check the Google signature and that the audience of the token is the client ID of your application. Based on this ID token, you can either issue your own token (just for the identification of your frontend user), create a backend session or to keep sending the Google ID token with each request.