The best practice for using federated login providers is to use the authorisation code grant flow (in OAuth) which requires you to manage sessions by yourself.