title: Storing Google Refresh Token in Database?
body: <p>I am building a web application which provide sign in with google option. Initially we ask <code>profile</code> and <code>email</code> scopes from user(offline access). In return we get a <code>code</code>. </p>
  
  <p>Using this code, I request a <code>refresh_token</code> and then an <code>access_token</code>. Both these tokens are stored on client side in cookies(you might say storing <code>refresh_token</code> on client side is a bad idea). </p>
  
  <p>In my app, I have provided user to be able to access his drive files. For this I use incremental scopes. So I ask drive permission from user. In return I get a <code>code</code> -> new <code>refresh_token</code> -> new <code>access_token</code>.</p>
  
  <p><strong>But the problem is :</strong></p>
  
  <p>When user clears cookies or log out. Then when he logs in, new <code>refresh_token</code> and <code>access_token</code> are generated which only includes scopes for <code>profile</code> and <code>email</code>. So I have to ask user again for his drive permissions. I don't want to ask user every time for his drive permission after he already gave them.</p>
  
  <p><strong>Possible Solution :</strong></p>
  
  <p>Storing the <code>refresh_token</code> on server side?? Is this the right way??</p>