1

I need some help with my authentication design. Happy to share any code as needed...

Overview

I have implemented the Google Sign-in (new web implementation here) button in my client web application. The web app prompts the user to authenticate through google, revives a JWT token from google, POST to a golang web server, which validates the JWT using the golang idToken library from google (example), and finally the information is used to check if a user exists in the server database.

Here is where I'm confused. Google mentions in their Sign in Documentation that after the steps I have outlined above that:

You'll manage per user session state for sign-in to your site...Users may remain signed-in, sign-out, or switch to a different Google Account while maintaining an active, signed-in session on your website...From here, you might: choose to simply allow the verified user to access pages on your site

Questions:

  1. How would I implement the user session state to verify on all pages that a user is "signed in"?
  2. How would I implement a "sign out" functionality if it is independent of google?
  3. How would I handle JWT tokens that may have expired due to the (exp) expiry time?
  4. What should be stored on the browser and what should be stored on the server?

Thank you for your time and consideration!

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.