Here's the idea:
- I have a website where I offer to users to log-in/sign-up via social networks(in this case Facebook and LinkedIn)
- When a user authenticates with either provider I look-up the users in my DB and see if there's already a user that has the same social network ID added to their profile.
- If there is - they get logged-in
- If there isn't, a new user is registered in my DB.
Now the question is - since I can get the user's email on the social network I can look-up my users based on that as well. Should I proceed and log them in at that point or is that considered a security breach(since depending on the social network you can possibly change your email to one that you don't own, thus breaking into someone else's profile)?
Because they might have already registered an account using the standard registration form and then forgot that they've done that and clicked on the social network login button. Obviously you don't want them to get a new profile(and technically they can't since that email is already used).
Or perhaps if a user with that email already exists, then I can display a message to the user that says something like
An account with your email already exists. Please log-in with that email and your password using the form below and then add your social network profile in order to be able to log-in with it in the future.
PS: I already asked the same question on webapps.stackexchange.com but it turned out to be the wrong place for it. By looking at the guidelines for questions on this site it seems like it's the appropriate place to ask the question, but if it's not I'd be happy if someone points me in the right direction.
This way once they log-in with their on-site account, they can authenticate with the service again and a connection between their account on the service and their local account would be made, allowing them to log-in with it in the future.