Security review for new OAuth integration

Context

We're adding Google OAuth for enterprise SSO. Before we ship, we need security review from the team.

Options Considered

1. Auth0 - managed service, higher cost
2. Custom OAuth - more control, more responsibility
3. NextAuth.js - good middle ground

We're going with NextAuth.js + custom session handling.

Recommendation

Proceed with NextAuth.js but with custom token storage in Redis for better session management.

Trade-offs

• More complex than pure NextAuth
• But: Better control over session invalidation and multi-device handling

Questions for Team

• Token refresh strategy?
• Session timeout duration?
• How do we handle compromised sessions?

Please ack after reviewing the security implications.