A Java web server needs to call Google Cloud APIs on behalf of users who authenticate with their Google identities. Which authentication workflow should your web app implement?

The correct workflow involves redirecting users to Google's consent screen for Single Sign-On (SSO) and scope selection. After the user authenticates and grants consent, Google returns an authorization code to your application. Your server then exchanges this authorization code for an access token. This access token is then used by your server to make calls to Google Cloud APIs on behalf of the user. This is the standard and secure OAuth 2.0 flow for web server applications, ensuring user credentials are never handled by your application directly. The other options are incorrect because: Prompting for username/password and storing hashes or forwarding raw credentials are highly insecure and violate Google's security policies. Storing an authorization code in a user's browser cookie and reusing it directly to call APIs is insecure and not how authorization codes are designed to be used; they are exchanged for tokens by the server.