in one of my projects I have implemented a login / registration with the OAuth from Google and Apple.
Now when I request a login I get back something like the following tokens:
My strategy is to send the ID token to my own backend to check if it is valid. I create the user in my own database with new internal credentials. I don't need and don't store the other tokens at all. The users are automatically logged in using the new credentials.
The login of the client is now always done automatically by the own credentials.
Does this strategy bring any disadvantages?
Should I still save the other tokens?
If so for what benefit?
If the user logs out, I simply repeat the process afterwards and recognize from the ID sent along in the ID token that he is already registered.
Thank you guys for your opinion and help.