title: How should the server for a single-page application handle expired oAuth tokens?
body: <p>As background, I'm using the Google OAuth2 NodeJS client, but I think my question is more abstract / technology independent.</p>
  
  <p>My website is single-page application that communicates via AJAX to the server.</p>
  
  <p>When a user first visits my website, I perform an OAuth2 flow which redirects them to Google to log in, and then redirects back to my site with an access token. I store this access token in a cookie, and use it to handle various calls made to the server via AJAX.</p>
  
  <p>My challenge is that I'm unsure what to do when that access_token expires. Should I be storing the refresh_token in a cookie as well, and using that, or are there security issues in doing so?</p>
  
  <p>Should I be redirecting the browser to perform the login flow again? That seems fairly ugly for a single-page application.</p>