Quintessential information from your sketch is presented in Google's official publications:
A volatile token is generated and signed by the issuer (Google) and usually expires after a rather short lifespan (related post, while not google-login-specific: What is intent of ID Token expiry time in OpenID Connect?). The Google docs describe how to send a token XYZ123 via https to https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=XYZ123
As @ian-barber writes here: "Be sure to always send ID tokens over HTTPS - though they can't be used maliciously in themselves, an attacker could use one to establish themselves a session with your app server if they could intercept it, so its important they aren't sent in plain text."
(Refreshed) tokens are to be used to authenticate users. Then your backend logic (the blue server part) can grant further privileges or e.g. transmit data in a post response. The API (JavaScript version) provides a toolset to monitor the user's session status.
As stated here, you must specify "authorized origins". Only authorized origins may validate their client users through the Google Identity API. Please note that even the port matters, i.e. if you allow localhost:8080 as an authorized origin, then localhost:9999 is not included! Additionally, the client ID per se is no secret and is naturally exposed in your html document or app. But only authorized origins are eligible to traverse the login workflow and transmit the token to the backend, where it is validated through calls to the API.
Videos
So when I sign in through google on my web application, I get the refresh token, access_token, and id_token.
Since I'm only using the basic scopes (read email, name, and other basic google account data) can I just send the client a cookie instead of sending the Access or ID token? This is what I'm thinking my application flow will look like:
user signs in through google
server stores refresh token in database or cache
cookie is sent to client side and expires in about an hour (same as Google Access Token Expiration)
if cookie is not sent from client (expired) during a request, we will authenticate with Google using stored refresh token, and if authenticated, send cookie to client and keep authenticating
if google doesn't authenticate refresh token, make them sign in again
Let me know if I'm getting this right or if you would make any corrections. I'm trying to make my application as secure as possible by allowing user to login through google and I'm trying to do authentication myself to learn.