Google+ Sign-In with PHP

Question

I'm a bit confused. I am trying to provide a simple Google Authentication sign-on.

I would like to use Google's recommended method using the client-side flow: https://developers.google.com/+/web/signin/add-button

If I use this method, how will I keep a user logged in as they move from page to page. I know I can't create PHP session via Javascript.

How can I use the client-side flow and keep a user signed in. I am using PHP on my server.

Answer 1

After spending a few weeks researching, I now understand that I cannot just set a php session variable and stop using oAuth2. I realize that everything I need to get information from Google, I must prove that I have still authenticated that user.

Also, I have come to understand that unless you force prompt, Google will not resend a refresh-token. To provide the best user experience, you must capture the token at first login and then re-use the token to make calls without having to force prompt. This token must be stored in a secured location such as a database for each user.