Storing access tokens and handling their expirations

Question

I'm using OAuth as:

1. a secondary method to sign users into my web application (rather than manually providing their name, email and password)
2. a way to receive to receive user data throughout the website.

---

What would be considered best practice when storing access tokens? I have two options:

1. Store access tokens in cookies
2. Store access tokens in a database

What are the advantages and disadvantages of either choice?

---

Regarding token expirations, what should be done to handle this?

One way I know I could handle this is by checking whether there was an error when calling the API and so requesting a new token and then calling the API again. However when requesting a new token, will I require the user to sign back in again? I would imagine this would be a problem when a page on my website requires data from Facebook, but to retrieve it, users have to log back in.

I don't understand how other websites manage to maintain access to Facebook, Google or Twitter APIs without requiring me to log back in again, especially when I'm on another device where I haven't once logged in to Facebook, Twitter or Google. How do they do this? Thanks.

Answer 1

If authentication is done using Google OAuth2.0. Google provides two tokens namely, Access Token and Refresh Token.

Access tokens have limited lifetime for 3600 seconds , but refresh tokens are valid for longer period of time.

Refresh token also expire. Read "Token expiration" section of the Google OAuth2.0 link

One can obtain new access token from refresh token without re-login. ReST api

So, one can have logic implemented to check for time elapsed after access token was generated and take precautionary steps for new access token generation. Google tokens expire in 3600 seconds, so one can get access token say after every 3500 seconds and update the older access token stored with new one for further use. Also one other way could be, to set refresh token in GoogleCredential which is passed as parameter(httpRequestInitializer) while creating the service of any api.(For example look for Drive.Builder)

If you are not storing refresh token from which access token can be regenerated, you have to authenticate again to get new token.