Android Google+ Session

Question

I'm using Google+ authentication in my app to allow a user to sign in, and have access to their 'data' on my server.

The authentication process following the following steps:

1. User logs in using Google+ on the app, and receives an access token.

2. The user passes this token to the server.

3. The server uses this token to verify that the user is who they say they are (following the process shown here ). The server can return the data as needed.

4. This is the part I'm stuck on - How do I verify that the user is who they say they are for future requests without making a request to Google's servers every time? Do I return a session token to the client application that is used, and regenerate the token after some amount of time?

Answer 1

Absolutely. Sending a session cookie is exactly the thing to do.

Answer 2

You will want to use ID tokens to verify that the user is who they say they are. There is a sample project in Java on Github to demonstrate this .

Also, you should be passing a one-time authorization code to your server, not access tokens. See the documentation for getting your server side tokens from an Android app . When you have that code, you send that to your backend and then exchange that one-time code for the server's own copies of access and refresh tokens for that user. Because you receive the tokens directly from Google on your backend they are more secure than having to send between mobile apps and your backend.