Linking accounts

[ziedHamdi]

Description 📓

I can't log in from two oauth providers where I subscribed using the same mail: I was expecting the lib to detect that a user with that email is already in the database, and add it a new mail. I get a user unfriendly error: "To confirm your identity, sign in with the same account you used originally."

Where the user may have forgotten which provider he previously used to subscribe (especially if I propose multiple possibilities)

How to reproduce ☕️

Subscribe using a first provider ex: facebook, then try to log in with an account eg: google (where your email is the same

)

Contributing 🙌🏽

Yes, I am willing to help implement this feature in a PR

[ziedHamdi]

Ok I just found the answer in the section:
When I sign in with another account with the same email address, why are accounts not linked automatically?
https://next-auth.js.org/faq

[ziedHamdi]

However, the error text is not clear for the end user: he might have forgotten which account he used to subscribe.

Also the provider could be added in a pending state. The user can then connect with his 'original account' then confirm he owns that secondary account too.

[balazsorban44]

For accounts to be linked together securely, you have to be logged in with an account with the same email while linking the new account. it's a design choice, outlined in https://next-auth.js.org/faq#security

we don't intend to chnahe this behavior, but we plan to make it easier to implement account linking in the future

[ziedHamdi]

I saw that, and I closed the issue before reopening it to say the error message is user unfriendly, since it doesn't tell which provider he signed in with, and the provider can be put in a 'pending' state until it is validated by the user (logged in regularly).

[balazsorban44]

I mean they just clicked the "sign in with..." button, no? 🤷‍♂️ And we cannot leak which other providers that email address is associated with.

[ziedHamdi]

I think this can be subject to discussion, knowing that some email that ends with @gmail.com is a Google account :-) (or simply exists) is a risk some businesses might be ready to take in exchange of their users churning less because it's easier to sign in.
I think that knowing an email has an account on Facebook is not a dangerous leak.

Finally, I think a company could allow its users to reveal this type of info or not in their security settings.

What are your thoughts?