Fix OAuth account_email not being updated on re-authentication #8831
+52
−14
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When a user re-authenticates with an OAuth provider (Google, Apple, GitHub) after changing their email on that provider, the account_email field was not being updated - only account_username was updated. This caused a mismatch where users logging in with one email would be linked to an account with a different email in our database. The fix ensures account_email is always updated alongside account_username when updating existing OAuth accounts in both get_updated_or_create() and link_user() methods for all three providers.
Previously, when a logged-in user clicked "Login with Google/GitHub/Apple", the OAuth flow would store their user_id in state, causing the callback to call link_user() instead of get_updated_or_create(). This could link a different OAuth account to the existing user instead of logging them into the correct account. This change adds an explicit `intent` query parameter to the OAuth authorize endpoints: - `intent=login` (default): Always uses get_updated_or_create() for login/signup - `intent=link`: Uses link_user() to connect an OAuth account to current user The frontend now passes `intent=link` only from the Authentication Settings page where users explicitly want to connect an OAuth account.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 2 Skipped Deployments
|
Contributor
📦 Next.js Bundle Analysis for webThis analysis was generated by the Next.js Bundle Analysis action. 🤖 This PR introduced no changes to the JavaScript bundle! 🙌 |
Member
|
Superseded by #8880 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When a user re-authenticates with an OAuth provider (Google, Apple, GitHub)
after changing their email on that provider, the account_email field was not
being updated - only account_username was updated. This caused a mismatch
where users logging in with one email would be linked to an account with a
different email in our database.
The fix ensures account_email is always updated alongside account_username
when updating existing OAuth accounts in both get_updated_or_create() and
link_user() methods for all three providers.