Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

imagine you secured your application with oauth2 and several oauth providers.

Now imagine someone using provider A with email to log in.

Next time, someone uses provider B with the same email to log in.

Both provider state that the email address is verified and both are big companies (no way to specify you own provider or something like this).

Should you map both logins to the same account? What are the risks?

The risks I already see are that the attack surface is getting bigger: if I want to hack the account of Bob, I can try to hack provider A or B. But the benefit would be more convenience for Bob, since he will not have to remember which provider he used...

share|improve this question
I'm not sure how email addresses have anything to do with OAuth providers. Can you explain? – Xander Jun 13 '13 at 13:23
Good point. My perception is that the email address is as good as a unique user-id. So when I use an oauth provider to authenticate a user, I request at least the email address from the provider in order to identify the user... doesn't this make sense? – rdmueller Jun 13 '13 at 13:34
up vote 5 down vote accepted

First of all insure that each OAuth provider actually verifies the users email address. Google and Facebook do this, but not every site will verify your email address (reddit is an example). Google and Facebook are on the ball when it comes to security, and I doubt they will be the weakest link. However, defense in depth is admirable quality.

A simple solution to the problem of using the email address as the unique identifier is to email the user and ask them to click on a link which confirms that both OAuth providers should be linked.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.