Whose fault/bug is it in the below case?

Question

Say there are 2 servers a.example and b.example. b.example uses 3rd party authentication from a.example via OAuth or other protocols.

Now a user user1 with account [email protected] logs in and sets up a account on b.example using auth from a.example. After some time he deletes his account [email protected] on a.example . But he hasn't deleted his account on b.example.

Another user (user2) coincidentally/intentionally creates an account on a.example with the same username i.e [email protected]. Now after some time he comes across b.example website and tries to login via his a.example account i.e [email protected] since b.example allows a.example's OAuth. But what happens is b.example instead of taking this user2 to fill up his account profile on b.example, it takes user2 directly to user1's previous account which used the same account username [email protected]. And user2 can see all of user1's past activity on b.example.

Then which is at fault in the above logic if it happens? a.example or b.example or the user user1.

Answer 1

The "auth" in OAuth is for authorization, not authentication. It does not verify the identity of someone, but rather is used to grant one application access to another application on the user's behalf, within a predefined scope of permissions.

This is a common area of confusion that leads to issues like you've described. Instead, a protocol that is designed for authentication should be used, such as OpenID.