search

julianlam / nodebb-plugin-sso-facebook

Single Sign-On Plugin for NodeBB
BSD 2-Clause "Simplified" License
19 stars 19 forks source link

Unintended ability to associate more than one Facebook profile with NodeBB account #45

Closed gwynnarth closed 6 years ago

gwynnarth commented 6 years ago

There is no easy way to see how many FB accounts are linked to a certain NodeBB account or any way disassociate a particular FB profile from a NodeBB account.

An unintended side-effect is that the FB profile link on /user/ always points to the FB account that was last used to login into NodeBB.

There is no limit of FB profiles that can be associated with a NodeBB account. While one can argue that this is not a bug, but a feature, NodeBB should either list clearly all FB profiles associated with an account and add ability to disassociate, or simply disallow associating more than one FB profile with a NodeBB account.

julianlam commented 6 years ago

v3.3.0.

Existing situations where a user has multiple accounts associated, will remain for backwards compatibility.

However, any new associations will throw an error and abort the login if the target nodebb account already has a (different) fbid associated with it.