Social login - authenticate if email exists or create new user

Question

Here's the idea:

• I have a website where I offer to users to log-in/sign-up via social networks(in this case Facebook and LinkedIn)
• When a user authenticates with either provider I look-up the users in my DB and see if there's already a user that has the same social network ID added to their profile.
• If there is - they get logged-in
• If there isn't, a new user is registered in my DB.

Now the question is - since I can get the user's email on the social network I can look-up my users based on that as well. Should I proceed and log them in at that point or is that considered a security breach(since depending on the social network you can possibly change your email to one that you don't own, thus breaking into someone else's profile)?

Because they might have already registered an account using the standard registration form and then forgot that they've done that and clicked on the social network login button. Obviously you don't want them to get a new profile(and technically they can't since that email is already used).

Or perhaps if a user with that email already exists, then I can display a message to the user that says something like

An account with your email already exists. Please log-in with that email and your password using the form below and then add your social network profile in order to be able to log-in with it in the future.

PS: I already asked the same question on webapps.stackexchange.com but it turned out to be the wrong place for it. By looking at the guidelines for questions on this site it seems like it's the appropriate place to ask the question, but if it's not I'd be happy if someone points me in the right direction.

This way once they log-in with their on-site account, they can authenticate with the service again and a connection between their account on the service and their local account would be made, allowing them to log-in with it in the future.

Answer 1

I would strongly suggest independently authenticating every method used. These sites may offer user email information and I think it might be appropriate to use email as a contact method, but I wouldn't use it as a login without the user being able to demonstrate control of both methods that are being combined.

For example, Jane has her Facebook account compromised but was smart enough to use a different password for her email (or perhaps the compromise was through a method that didn't involve a password at all). She might recover that account at a future point, but an attacker could also use it to leverage a takeover of her account on your site.

For this and many other reasons I recommend that if a user is trying to combine multiple access methods, you should properly authenticate with at least one of the old ones and the new one during session where you combine them.