imagine you secured your application with oauth2 and several oauth providers.

Now imagine someone using provider A with email bob@example.com to log in.

Next time, someone uses provider B with the same email bob@xample.com to log in.

Both provider state that the email address is verified and both are big companies (no way to specify you own provider or something like this).

Should you map both logins to the same account? What are the risks?

The risks I already see are that the attack surface is getting bigger: if I want to hack the account of Bob, I can try to hack provider A or B. But the benefit would be more convenience for Bob, since he will not have to remember which provider he used...

  • I'm not sure how email addresses have anything to do with OAuth providers. Can you explain?
    – Xander
    Jun 13, 2013 at 13:23
  • Good point. My perception is that the email address is as good as a unique user-id. So when I use an oauth provider to authenticate a user, I request at least the email address from the provider in order to identify the user... doesn't this make sense?
    – rdmueller
    Jun 13, 2013 at 13:34

1 Answer 1


First of all insure that each OAuth provider actually verifies the users email address. Google and Facebook do this, but not every site will verify your email address (reddit is an example). Google and Facebook are on the ball when it comes to security, and I doubt they will be the weakest link. However, defense in depth is admirable quality.

A simple solution to the problem of using the email address as the unique identifier is to email the user and ask them to click on a link which confirms that both OAuth providers should be linked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.