This is to prevent any security issue, if you want to allow that for your user, you need to add the auth provider in the metadata and set it to true
#medusa-plugin-auth get back error when already exists
idle junco
severe tapir
This is to prevent any security issue, if you want to allow that for your user, ...
hi thanks for your response, I am not sure what security issues associated with it, but if the user sign in with Google the first time, and i see right now with default, if they login again i get back the error. is it not good to allow user continue with Google everytime?
idle junco
The is the default behaviour of that plugin, if the user sign in with google, the auth will be using google and the user won’t be able to use another method
What I understand from your first question is that someone is trying to log in with google, but the email already exists and it means that the user sign in with his email. Therefore the email become his auth method
If you look at the documentation the behaviour and flow is described on each page for each method 😅
regal torrent
@idle junco wouldn't the correct flow be to link both auth methods just like firebase handles such cases?
idle junco
I am not sure but that is something you can decide yourself by changing the callback. The security issue would be that someone could authenticate on your behalf through another provider.
Lets take the following scenario :
- you use a classic email/pass account
- someone hack you email account
- this person go to authenticate using another provider (here the email provider) and gets authenticated to your account
In most cases the platform does not allow that.
regal torrent
@idle junco I think if you get your Gmail hacked, your online store account is your smallest problem at this point. Feel free to disagree. If I login with Gmail in Medusa store and my gmail gets hacked then the protection is basically zero. Is it really worth the dev discomfort given the attack serface it covers? Your example above is good but what percentage of the use cases does it cover given how easier it is to create social login in Medusa vs user/pass that users have to remember/save?
idle junco
I see, what we could have is an extra option for the plugin (strict) and by default it is, but if you disable it it let you do what you are asking? Wdyt?
brisk ibex
Just to add my thoughts, I would LOVE such an option.
regal torrent
@idle junco sounds good
idle junco
@brisk ibex @regal torrent I ve started to add the support of the options https://github.com/adrien2p/medusa-plugins/pull/84, just need to find time to finish it. Let me know what do you think
regal torrent
@idle junco is there an option to keep the auth method of the user in DB. For instance if I know that a user has logged in with user/pass then i should offer password reset functionality. But if the user has registered with google then it is not needed? Thanks