Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
Demo, all content is generated
Question

OAuthAccountNotLinked when a user who signed up with GitHub tries Google

Open · 835 views · asked by noah_s · edited
windsurfnextjsauthsecurity

Auth.js with Prisma adapter, GitHub and Google providers. A user signed up with GitHub, later clicked Google (same gmail address) and got

[auth][error] OAuthAccountNotLinked: Another account already exists with the same e-mail address.

Windsurf says to add allowDangerousEmailAccountLinking: true to both providers. The word 'dangerous' is in the name though. Is it actually dangerous?

What I’ve tried

Added the flag on a branch, it works. Haven't merged because of the name. Read the Auth.js docs page on it.

Comment
Which adapter/DB? Prisma I assume from the error format. chidi_eze · edited

3 answers

amir_h · edited

I'd be more careful than 'fine' on the GitHub side. GitHub lets people add emails and the provider can hand you an address from the account. If you can't be sure it's verified, auto-linking by email is exactly the takeover path the flag warns about.

What I do:

  • allowDangerousEmailAccountLinking: true on Google only.
  • For other cases, show a page: 'You already have an account with GitHub. Log in with GitHub, then connect Google in settings.' Linking while logged in is safe because you know who's asking.

Slightly more work, no guesswork about which provider verified what.

Comment
Fair, the 'link while logged in' flow is the cleaner answer. I'd still call Google-only the pragmatic minimum. chidi_eze · edited
Going with Google-only flag for now, settings page later. Thanks both. noah_s · edited
chidi_eze · edited

For Google specifically it's fine. The risk the name warns about: provider X lets someone register with your email without verifying it, then they log into your account via linking. Google accounts have verified emails, so linking on Google is safe in practice. Turn it on for Google.

Comment
Agree on Google, see my answer on GitHub though. amir_h · edited
tom_brewer · edited

For comparison: Supabase Auth links identities with the same verified email automatically, and refuses when the email isn't verified. That's basically amir's rule, built in. If you're early enough, that's one less thing to build.

Comment

Related

middleware.ts crashes: The edge runtime does not support Node.js 'crypto' modulesolved
Firebase rules let anyone read my whole users collectionsolved
Windsurf generated an API without any auth, how do I add it afterwards?solved
Hundreds of fake signups overnight, all with random gmail addressessolved
Users can give themselves unlimited credits by editing their own profile rowsolved

Your answer

Sign in to write an answer