(1) If you are using oauth2 flow like below:
https://developers.google.com/identity/sign-in/web/server-side-flow
with google-auth-library in a Node.js RESTful api and want to make an authenticated call to Cloud Storage, what is the best practice (security, scalability, readability, common/popular patterns) for passing the credentials (access_token/id_token) from the auth flow endpoints to the Cloud Storage endpoints?
EXAMPLE SUDO CODE:
FILE A server/AuthController.js
router.get("/generate-auth-url") //generates auth url to send to client
router.get("/auth-callback") //google Api calls this in step 5, we exchange the code for an access_token and id_token, HOW DO WE PASS THIS DATA AROUND?
FILE B server/CloudStorageController.js
router.get('/some-cloud-storage-json-file')
which calls const storage = new Storage({ credentials, projectId: "some-project-id" }); //how do i get credentials here from AuthController?
Bonus Questions:
(2) how do I validate auth on every follow up api call to an endpoint that accesses cloud storage data?
(3) what data do I need to store to maintain user session/authorization in your web app? (ex: access_tokens, id_tokens, refresh_token, cookies, etc)
(4) Where do I store said auth data? (ex: browser cookies, browser localStorage, nodejs session storage, database? (do you need a db for this architecture?), etc)