I want to allow users to link/unlink several OAuth providers to their account.

How can I mitigate 'office prank' attacks, when someone can access my computer while I am away?

My account: OAuth with Facebook.

Attack 1: Attacker logins with his Google account, and links to mine.

Attack 2: Attacker clicks 'unlink' my Facebook account.

Revoking tokens as a form of 'Time-of-check to time-of-use' does not work, since the computer is already logged in with Facebook (attacker can click allow again).

Maybe fallback to using associated OAuth email (assuming there is one), and generating OTP tokens?

1 Answer 1


It looks like you want to achieve re-authentication of a user before an account linking/unlinking operation. In your example a user would be authenticated with her Facebook login at an application. When the user (or attacker) tries to link a second social login the application would request re-authentication from Facebook. It is described here: https://developers.facebook.com/docs/facebook-login/reauthentication/ After re-authentication the app can start the account linking process.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .