Currently when logging in with a social account it will only allow login if the account is linked to a user. If a matching email is found it will not auto-link based on email address but advise the user should link their account in settings.
Similarly, When registering via a social account it will display an error if the user already exists and they're required to log in to link their account.
It would be a nicer user experience to simply always link on email address if possible.
Just wondering if anyone has any thoughts on the security of linking based on email address?
Really I suppose it comes down to the security of the oAuth service but if it's trusted for new registrations it might as well be trusted for linking to existing contacts?
Currently when logging in with a social account it will only allow login if the account is linked to a user. If a matching email is found it will not auto-link based on email address but advise the user should link their account in settings.
Similarly, When registering via a social account it will display an error if the user already exists and they're required to log in to link their account.
It would be a nicer user experience to simply always link on email address if possible.
Just wondering if anyone has any thoughts on the security of linking based on email address?
Really I suppose it comes down to the security of the oAuth service but if it's trusted for new registrations it might as well be trusted for linking to existing contacts?