I need some help with my authentication design. Happy to share any code as needed...
Overview
I have implemented the Google Sign-in (new web implementation here) button in my client web application. The web app prompts the user to authenticate through google, revives a JWT token from google, POST to a golang web server, which validates the JWT using the golang idToken library from google (example), and finally the information is used to check if a user exists in the server database.
Here is where I'm confused. Google mentions in their Sign in Documentation that after the steps I have outlined above that:
You'll manage per user session state for sign-in to your site...Users may remain signed-in, sign-out, or switch to a different Google Account while maintaining an active, signed-in session on your website...From here, you might: choose to simply allow the verified user to access pages on your site
Questions:
- How would I implement the user session state to verify on all pages that a user is "signed in"?
- How would I implement a "sign out" functionality if it is independent of google?
- How would I handle JWT tokens that may have expired due to the (exp) expiry time?
- What should be stored on the browser and what should be stored on the server?
Thank you for your time and consideration!