Security on linking multiple oAuth2 services by email to the same user

Question

My problem is as follows:

I want to associate multiple oauth2 accounts to the same user by email (e.g. the design of medium.com or slant.co). I need to understand the security consequences about this scenario.

1. user User_A registers to my website using email Email_A
2. user User_B registers to Facebook using Email_A (let's say by mistake) where User_A doesn't have a Facebook account.
3. User_B logs in on my website using his Facebook account.
4. My website associates User_B to the account User_A.

This scenario is really impossible for something like Google, but it's possible for Facebook or Twitter backends. There is no way to make sure that User_A really owns all services using the same email, right? If I am right, what are the measures to make sure that a user cannot login to another user's account?

Answer 1

Great question and many developers don't do the right things in these cases. When we built Firebase Auth (previously knows as Google Identity Toolkit and you can see some detail on that page ) we spent a lot of time to analyze these cases. It will be hard to describe in detail here but a few concepts will help.

• Authoritative IDP: Understand who is authoritative for a particular identifier. e.g. @gmail.com Google is authoritative and for @yahoo.com emails Yahoo is authoritative. This means when Google returns that someone has [email protected] email you can safely assume that they definitely have control of it.

Depending on the sensitivity of the data on your site and how you allow "account recovery", you could always allow sign-in through an authoritative IDP but when if the user tries to sign-in with another IDP that is not authoritative, you should require them to confirm original account credential at the time of merging (e.g. ask for pw or ask to for assertion from Google before allowing to take over the account with just facebook sign-in).

Hopefully that helps. It is complicated so being careful is better and unmerging is going to be almost impossible.