Unable to login through passport strategy if local account exists. about next-auth HOT 5 CLOSED

Also I think we could resolve it by marking some identity providers as safe (false by default), to prevent such situation. I understand that there are some strategies (like OpenID) that allow users to make their own auth server to forge other users' identity, but if we are talking about trusted centralized identity providers like GitHub, we can safely let users to sign-in through them even if there are local accounts associated with their emails, right?

from next-auth.

Thanks for raising this - I dislike the current user journey for this flow too.

I like the idea of a much better option for the user that asks them to confirm what they are trying to do rather than giving them a confusing error. I haven't sat down to think about the flow for a while so I can't remember if there are any edge cases off hand.

I think it page currently gets passed what service the user tried to use with a view that it might be possible to improve it later. I'd welcome any PRs to improve the behaviour! I've tried to focus on a secure-by-default but the user experience isn't great in this case.

Having the option to mark providers as trusted in some way sounds reasonable. I think many providers these days require you to validate your email address before you can use it for oAuth, which would - in practice - be sufficiently secure for many cases.

from next-auth.

@iaincollins Could you please take a look at PR #64?

Looks like redirecting to a confirmation page with a password input would require a temporary state to keep profile data received from external identity provider in order to use the data for creating an account after the intent confirmation. I didn't want to introduce a breaking change, so I ended up sticking with the second option we were talking about: trustedIdentity property in provider config.

Thanks!

from next-auth.

Oh that's great thanks, will comment on the PR!

from next-auth.

PR #64 is now merged but not rolled out in a new version on NPM yet. I'd like to update the template pages and documentation, and ideally get some automated testing in place in the next few days before we do that.

from next-auth.