Google 登录不需要每次都需要用户同意.如果您使用 OAuth2 登录程序，您应该能够在没有重新批准的情况下再次登录:https://developers.google.com/accounts/docs/OAuth2Login

Google login does not require user consent every time. If you're using OAuth2 Login procedure, you should be able to login a second time w/o re-approvals: https://developers.google.com/accounts/docs/OAuth2Login

但是，在某些情况下，自动批准可能会被禁用，随后每次登录都需要用户同意.

In some contexts, however, it is possible for auto-approval to become disabled, with the subsequent requirement of user consent on every login.

第一种也是最常见的情况是，如果您的应用程序明确要求 Google 每次都提示同意.检查您的授权请求(您可能已从示例或示例代码中复制)是否包含prompt=consent"或较旧的非标准形式approval_prompt=force".删除这些参数(如果存在)可能会导致自动批准开始工作.

The first and most common case is if your application explicitly requests Google to prompt for consent everytime. Check if your authorization request (which you may have copied from an example or sample code) includes 'prompt=consent' or the older, non-standard form 'approval_prompt=force'. Removing these parameters (if present), will likely cause auto-approval to start working.

另一种情况是，如果您的重定向 URL 基于本地主机"或不属于全局 DNS 命名空间的其他 URL.在这种情况下，出于安全原因，谷歌在用户计算机上的accounts.google.com 域中设置了一个cookie，以表示用户授权_this_device_ 登录localhost(或本地域)上的'foo'；如果 Google 找到了 cookie，它只会在不同意第二个请求的情况下自动批准.原因是localhost"(或本地域，或其他未建立在全局 DNS 命名空间上的 URL)的含义取决于设备，并且允许跨设备应用授权可能会带来安全风险.因此，如果您的公司已将浏览器配置为在退出时清除所有 cookie，并且您使用非绝对 URL，您可能会看到您的用户每次都必须同意.解决方案是将您的端点托管在 Internet 有效的主机名上(不需要从 Intranet 外部访问该主机，只需主机名需要全局有效)，或者您需要免除 account.google.comcookie 清除政策.

Another situation is if your redirect URL is based on 'localhost' or some other URL that does not belong to the global DNS namespace. In this case, for security reasons, Google sets a cookie on the user's computer, in the accounts.google.com domain, to signal that the user authorized _this_device_ to login to 'foo' on localhost (or local domain); Google will only auto-approve w/o consent a 2nd request if it finds the cookie. The reason is that the meaning of 'localhost' (or local domain, or other URL not built on global DNS namespace) is device-dependent, and allowing the authorization to apply across devices could introduce security risks. So if your company has configured browsers to clear all cookies on exit, and you use a non-absolute URL, you could see your users having to consent everytime. The solution is either to host your endpoint on an Internet-valid hostname (the host doesn't need to be accessible from outside the Intranet, just the hostname needs to be globally valid), or you need to exempt accounts.google.com from the cookie clearing policy.