title: Java backend: REST, authenticated with Google sign in, now what?
body: <p>I have an application which is composed by a javascript frontend, and a Java backend deployed in Tomcat.
  The communication between frontend and backend is all via REST. I am using Jersey for this.</p>
  
  <p>I followed the official documentation to add Google sign-in in my application: 
  <a href="https://developers.google.com/identity/sign-in/web/" rel="nofollow">https://developers.google.com/identity/sign-in/web/</a>
  and successfully managed to authenticate with the backend:</p>
  
  <pre><code>GoogleIdToken idToken = verifier.verify(idTokenString);
  if (idToken != null) {...
  </code></pre>
  
  <p>The question is: <strong>how do I have to proceed now?</strong> Following the documentation here
  <a href="https://developers.google.com/identity/protocols/OpenIDConnect#authenticatingtheuser" rel="nofollow">https://developers.google.com/identity/protocols/OpenIDConnect#authenticatingtheuser</a>
  it says</p>
  
  <blockquote>
    <p>After obtaining user information from the ID token, you should query
    your app's user database. If the user already exists in your database,
    you should start an application session for that user. ...</p>
  </blockquote>
  
  <p>Should I just start a normal java webapp session? (with the only difference that I got the user credentials from Google instead of directly from my frontend).</p>
  
  <ul>
  <li>If yes, how do I start the application session?</li>
  <li>If not, what do I have to do?</li>
  </ul>
  
  <p>I am completely lost here. Please help.</p>