search

datamweb / shield-oauth

OAuth for CodeIgniter Shield
https://www.shield-oauth.codeigniter4.ir/
MIT License
57 stars 16 forks source link

Using email as auth identity is unreliable #38

Open pixobit opened 1 year ago

pixobit commented 1 year ago

PHP Version

8.1

CodeIgniter4 Version

4.3.2

Shield Version

1.0.0-beta.3

Shield OAuth Version?

dev-develop

Which operating systems have you tested for this bug?

Windows

Which server did you use?

apache

Database

MySQL 5.6

Did you add customize OAuth?

YES. It's not public

What happened?

When signing in with google or github, using the email as authentication identity is fine, but when you add facebook for example, it already breaks, since facebook doesnt always have an email available. A more reliable way would be to use the id, and only pull the email if available

Steps to Reproduce

Use the facebook OAuth available in the discussions, and try signing in with a fb account where you used phone number to sign in

Expected Output

To be able to sign in without unexpected error

Anything else?

I hope i managed to make it as clear as possible, but if not, let me know, and will try to add some sources for explanation

JamesShaver commented 5 months ago

I'm curious if there's been any thought about how to get around this issue? Would it be as simple as changing the Shield Login Identifier to phone?

Zoly commented 1 month ago

How about validated attached authentication accounts?

The user is logged in and in his user profile page he can choose to add additional authentication accounts. After validating that he owns the newly requested account, the two login identifiers are linked, and whichever login method he chooses later on, both are identified as the same account.

In case the requested account is already in existence, by passing the validation process it is confirmed we are dealing with the same user and the two login identifiers can be safely be merged into one account, specifically the account he made the requested from, after notifying the user of the fact that he will loose access to the personalized settings that can't be merged in the account he tries to attach.