Using Google Sign-In seamlessly across subdomains and projects

Question

I'm using a single Google Sign In Client ID across multiple google cloud projects and subdomains.

The Google Sign In OAuth is set up in project A, which is served at subdomain1.commondomain.com. The Sign In works seamlessly across browser windows when requesting routes from the same exact subdomain + domain combination, i.e. app engine service. When I sign out in one window it automatically signs out in all the other windows of the same exact subdomain + domain combination (app engine service).

Then in project B, another app engine service is served at subdomain2.commondomain.com. I'm using the same Google Sign In Client ID. I'm not asked to approve access to a scope when signing in. I have to manually click the sign in button when I navigate to subdomain2 for the first time.

When I sign out in one app engine service, the windows requesting another app engine service from another project stay logged in until I sign out manually.

I assume that's normal behaviour, but is there a way to tweak this set up so that it gives me the client experience as if I was just using the sign in on one single app engine service on one subdomain?

Answer 1

It sounds like you're not passing the token you received from a completed OAuth login to your other projects and services so that they can attempt to validate it before resorting to a new login process. You should be storing it someplace all of your projects can access such as Datastore or Memcache.