I have a front end app which obtains ID token from Google. This token is valid for 1 hour.

When user logs in I want to use this token to either create an account if it doesn’t exist in my back end or get the user if it exists.

Since the token is only valid for 1 hour I cannot use it for securing the endpoints without expecting from user to login every hour (which is not acceptable). I figured I need to somehow create and maintain an http session in the back end and store the session key in the cookie.

My question is how do I do that with Spring Boot 3 and Spring Security 6?