IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Social login & account linking
Maya signed up with an email and a password. Today she taps "Continue with your social account", and it uses the same email address. Is that one account or two? Your goal: link accounts without handing a stranger the keys.
- Social login means another company checks Maya for you.
- "Same email" does not mean "same person".
- Link only when the email is verified and Maya proves the old account.
- Match on the stable
sub, not the email. - One user can have many identities. Always keep a way back in.
What social login is
Social login lets Maya sign in with an account she already has somewhere else. Your app does not check her password. Another company does. That company is an identity provider (IdP). It checks her and vouches for her. This is federation.
Most of the time this uses OIDC (OpenID Connect). The provider sends your app a signed ID token that says "this is Maya, and here is her email". New to this? Read the auth-code flow lesson.
The upside and the catch
Maya has no new password to invent or forget, and signup is one tap. The catch: you now trust someone else's word about who she is, most of all her email address. If the provider lets someone claim an email it never checked, that bad data flows into your accounts.
The account-linking trap
The shortcut is: "If the email matches an account, log them in." That is auto-linking by email, and it is a trap. It is safe only if the provider really checked that the person controls that email. Never link on the email claim alone: a forged email claim is an account-takeover button.
a courier with a parcel for "Maya". A stranger says, "I am Maya." The name matches, but the courier still asks for the delivery OTP that went to Maya's phone. A matching email is only the name. The re-login is the OTP.
Some providers issue a token with maya@example.com for a person who never proved they own that inbox. In the token, the email_verified claim is false or missing. An attacker who controls such a provider can claim Maya's email. Your auto-link then puts that attacker straight into Maya's real account. (JIT provisioning & account linking shows the same problem from the provider's side.)
Linking safely
Safe linking needs two separate facts, never just one.
- The provider verified the email.
- The user gives fresh proof of the existing account. She signs in to it again.
Match accounts on the stable subject identifier, the sub claim. Do not match on the email text. OIDC defines sub as a locally unique identifier that is never reassigned within that issuer. Emails change and get reused.
When you link, remove any password, session or recovery method set up before the email was verified. Better still, block use of an account until its email is verified.
Maya taps "Continue with your social account". The token says email_verified: true and matches her address. Your app still asks for her password once. She signs in, and her social sub is tied to her record. Later an attacker tries the same email through a provider that never verified it. He has no verified flag and no password proof, so there is no link.
Two loose ends
First, a person can delete a linked social account at the provider. If it was her only way in, she is locked out. So always keep a way back: a password or a second linked provider.
Second, one person can have many providers. Attach several identities to one user, each with its own verified sub. Then unlinking one never orphans the others.
Go deeper: The reverse trap: pre-hijacking
An attacker can also strike before Maya ever signs up. They create an account with her email and a password they know. The email is not verified yet. Later Maya signs in with a social login that has the same email. A careless app merges the two. Now the attacker's password still opens the account. Researchers Sudhodanan and Paverd called this "account pre-hijacking" (USENIX Security 2022). They found that at least 35 of 75 popular services had one or more such flaws.
Defenses: do not let an account be used until its email is verified. When you link accounts, remove any password, session or recovery method set up before the email was verified.
🧪 Interactive lab — enable JavaScript to play with this one.
See what a login token really says. Decode an ID token and check whether it carries email_verified with ID Token Check. Grade the scopes a social app asks for with Consent Check.