title: Login to Single Page Application with Google authentication and Google Oauth 2.0
body: <p>We are developing an SPA - full client base javascript application and need to authenticate our users to get access to the internals.</p>
  
  <p>As I found from the search we can outsource our authentication mechanism and use <strong>Google accounts</strong> for that. I learned from this site 
  <strong><a href="https://developers.google.com/accounts/docs/OAuth2Login" rel="noreferrer">https://developers.google.com/accounts/docs/OAuth2Login</a></strong> - 
  <em>How to deal with Google API and mechanism for authentication</em>.</p>
  
  <p>In the short word, we need:</p>
  
  <ul>
  <li>send request to google url with params to ask user to allow SPA use their personal data</li>
  <li>in case of success we get a token from Google</li>
  <li>we may use this token to get access to API we were asked and work with it.</li>
  </ul>
  
  <p>This is described well and I understand it and have some JS code to make it happen.</p>
  
  <p><strong>What I do not understand</strong>. </p>
  
  <p>I have an application with it's private data. I want use user's e-mail as the login, or user id (doesn't matter how to call it) to access app's internals, such as user's created tasks, user's profile, etc. So, to display user's created tasks in my SPA I need query database with the user's e-mail.</p>
  
  <p>I imagine the next scenario:</p>
  
  <ul>
  <li>user click <code>Login with Google</code> button</li>
  <li>we obtain an token - this means user was authenticated successfully</li>
  <li>we <strong>persist user and his e-mail to work with SPA</strong></li>
  <li>when user click <code>Logout</code> we clear all access data</li>
  </ul>
  
  <p><strong>Where should I persist this data?</strong> </p>
  
  <p>In case of <code>Forms Authentication</code> I understand that we pass login/password to server and if they match the database we create <code>Forms Ticket</code> and <strong>store it in cookie</strong>. </p>
  
  <p><strong>Is there any similar case with Google's auth?</strong> If I'll store user's email in cookie I think that's not very good from security reason. If I'll save a token - I'm not sure why I need it and how to use it in my SPA, I'm not using any Google API after authentication.</p>
  
  <p><strong>Do you have any example case how do we build our process in similar cases?</strong></p>
  
  <p>Thank you.</p>