zoul
commented
6 months ago Ovšem pozor, podle NextAuth.js ne každý OAuth provider ověřuje e-mailové adresy:
Automatic account linking on sign in is not secure between arbitrary providers - with the exception of allowing users to sign in via an email addresses as a fallback (as they must verify their email address as part of the flow).
When an email address is associated with an OAuth account it does not necessarily mean that it has been verified as belonging to account holder — how email address verification is handled is not part of the OAuth specification and varies between providers (e.g. some do not verify first, some do verify first, others return metadata indicating the verification status).
With automatic account linking on sign in, this can be exploited by bad actors to hijack accounts by creating an OAuth account associated with the email address of another user.
For this reason it is not secure to automatically link accounts between arbitrary providers on sign in, which is why this feature is generally not provided by authentication service and is not provided by NextAuth.js.
Automatic account linking is seen on some sites, sometimes insecurely. It can be technically possible to do automatic account linking securely if you trust all the providers involved to ensure they have securely verified the email address associated with the account, but requires placing trust (and transferring the risk) to those providers to handle the process securely.
Examples of scenarios where this is secure include with an OAuth provider you control (e.g. that only authorizes users internal to your organization) or with a provider you explicitly trust to have verified the users email address.
Takže bychom se měli omezit na externí služby, které nám garantují ověření mailu.
Výchozím způsobem přihlašování bude e-mail, viz #980. Pro uživatele to ale znamená, že musí odejít do mailového klienta a zpátky. Pro větší pohodlí jim tedy můžeme nabídnout alternativu v podobě přihlášení účty třetích stran – GitHub, Google a podobně. Z našeho pohledu je to vlastně jen nějaké externí flow, které nám ověří e-mailovou adresu uživatele, pak už pokračujeme standardně. NextAuth.js má pro přihlašování externími službami hromadu adaptérů, viz například GitHub.