title: Single-sign-on authentication vs authorization
body: <p>I'm implementing Facebook and Google SSO on my website using custom workflow (redirect urls, parsing on server side etc. - no javascript) and I got to the point I have access_token, token_type and expires_in and from Google also id_token and I am confused what to do next to authenticate the user.
  I read a little about authorization vs authentication, and that Facebook and Google SSO is OAuth2 which provides authorization, but not authentication, from which I understand that this way my web application is authorized to do something on behalf of the user, but I cannot be sure the user is the one who I think he is? My main source is this: <a href="https://stackoverflow.com/questions/33702826/oauth-authorization-vs-authentication">OAuth Authorization vs Authentication</a></p>
  
  <p>So, my question is, what should I do to be able to can consider the user logged in.</p>
  
  <p>Thank you</p>