For example, my website has Email/Password login and the "sign in with Google" button. If a user creates an account with their email and a password, then decides to sign in using the "sign in with Google" button, but using the same email as their email/password account, should we let them into their account? Or should the sign in attempt be blocked and the user redirected to the email/password login form?

Email/Password Account Email: [email protected] Google Account Login Attempt: [email protected]


1 Answer 1


This is an interesting problem. I would expect that in most cases the user does not remember that they had created a "real" (locally managed) account or that they want to switch to single-sign-on using their Google account.

I don't really see this as a potential attack vector since the attacker would need to have access to the Google account already which likely means that they have access to the users email too.

That's why I would suggest to provide the user with the information, that there is already a "real" account with this email and offer to switch this account to a single-sign-on using Google. If the user agrees a proper verification that the user has access to the email should be done anyways, similar on how this is done with a password reset with locally managed accounts. If the user instead does not want to switch the existing account they should be presented with the normal login option, i.e. logging into an account which is still locally managed with Google SSO should not be possible in this case.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .