2

Assuming that a 3rd party identity provider is reliable (eg; Facebook, Google, WindowsLive), is it safe to use email address (as provided by the service) to connect a user logging in with different providers to the same account?

For example, let's say I have a table that looks like this:

.-------------------------------------------------------------------.
| user_id | fullname | email        | facebook_ident | google_ident |
|---------+----------+--------------+----------------+--------------|
| 1       | John Doe | john@doe.com | 4362           | null         |
'-------------------------------------------------------------------'

If a user logs in via Google using email "john@doe.com", can I reliably connect him with user_id 1 (eg; set google_ident = "new_ident" and log him in as such)?

A few scenarios of concern:

  • If somehow the provider stops verifying the user's email address, someone can register on the service with an email he doesn't own and hijack the respective user on my system.
  • If, from my side, the user changes the email to one he doesn't own, he will be "passing on" his account to a user that happens to log in with that email later on (and hijack his account as well).

A possible solution I can see:

  1. Disallow users to create accounts when their email address is already in use
  2. Allow connecting of accounts only when user is already logged in
  • It all depends on how your application is programmed. I really don't get why you'd relate to the email address to use Google or Facebook's authentication. – Julie Pelletier Jun 30 '16 at 18:33
  • Well, my first thought was that the email will probably be common across accounts of the same user.... but in practice this could also not be true. – Christian Jun 30 '16 at 18:35
  • As far as I can see, the most reliable way is to only allow connecting accounts when the user is already logged in. – Christian Jun 30 '16 at 18:36
2

You're right that relying on a third party for your system's authentication can have certain drawbacks.

It's hard to grasp how you could consider letting a stranger (non authenticated user) link an existing account to another provider. That would certainly represent a huge flaw in your design.

Normally, when using third party authentication, you allow a user to create an account on your site through the third party identifier and also log in with that same method. You need to have that user already identified for any change they make to their account, especially when it comes to authentication details.

While it's not bad practice to link more than one provider to an account, it does lessen its security as that single account can become vulnerable to flaws of more than one system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.