title: Handle user session with access token + OAuth provider
body: <p>I am building a web application with a basic client-server architecure. The frontend runs with react (nextjs) and the backend is on rails. However, the questions will be more about the flow of the authentication/authorization + session handling on the frontend.</p>
  <p>I am using an Oauth provider to handle the <strong>authentication</strong> but don't need any authorization from their part as I don't need the resources of the oauth provider (ex. drive, calendar etc.)</p>
  <p>For the authorization, as I want to access resources of my API, it's the API itself that handles authorization on any request made by the client (frontend) to the rails API.</p>
  <p>Right now for the initial authentication this is the flow I'm using, Taken from <a href="https://blog.prototypr.io/how-to-build-google-login-into-a-react-app-and-node-express-api-821d049ee670" rel="nofollow noreferrer">https://blog.prototypr.io/how-to-build-google-login-into-a-react-app-and-node-express-api-821d049ee670</a>  : <a href="https://i.stack.imgur.com/k1loT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/k1loT.png" alt="Figure 1" /></a></p>
  <p>Implementation details important for the following questions :</p>
  <p>I am using JWTs as access token (those generated by my API) and I simply sign them using a secret key that's only available on my API so the access token is unreadable from the front end point of view.</p>
  <p>On the frontend, it is a react app and I used the following package to handle the OAuth flow <a href="https://www.google.com/search?q=google+react+login+access+token+or&amp;rlz=1C5CHFA_enCA923CA923&amp;oq=google+react+login+&amp;aqs=chrome.0.69i59j69i57j0i512l3j69i60l3.2591j0j7&amp;sourceid=chrome&amp;ie=UTF-8" rel="nofollow noreferrer">google-react-login</a></p>
  <p><strong>Information received, what to use from Google (OAuth provider)</strong>
  1- I receive(amongst other things) an IdToken and an access token from Google. Also I'm apparently supposed to receive a refresh token (which I didn't see). For my use case, all I need is the idToken from Google is that right?</p>
  <p><strong>Revoking of a refresh token (logout), flow for a re-login?</strong></p>
  <p>2- From my understanding access tokens need to be short lived for security reasons. So I need to return a refresh token to my client app to be able to generate new access tokens frequently. However, once a refresh token hits its expriy time, do I need to log out the user and prompt him to re-login through Google and basically redo steps 1 through 5 (Please refer to Figure 1)?</p>
  <p><strong>How to maintain the session through the access token</strong></p>
  <p>3- From the frontend perspective, can I assume that simply having a refresh token means the user is logged in? Once the server revoke the access token and the refresh token that means the user is logged out and I need to ouput a view of the web application for an unauthenticated user? That means after every page reload I need to check for the presence of an access and refresh token?</p>
  <p>Thank you</p>