signing in with different providers with same email

[juliusmarminge]

Adapter type

@next-auth/prisma-adapter

Environment

System:
    OS: macOS 12.4
    CPU: (8) arm64 Apple M1 Pro
    Memory: 275.30 MB / 16.00 GB
    Shell: 5.8.1 - /bin/zsh
Binaries:
    Node: 16.15.1 - ~/.nvm/versions/node/v16.15.1/bin/node
    Yarn: 1.22.15 - /opt/homebrew/bin/yarn
    npm: 8.11.0 - ~/.nvm/versions/node/v16.15.1/bin/npm
Browsers:
    Chrome: 103.0.5060.53
    Firefox: 100.0
    Safari: 15.5
npmPackages:
    next: 12.2.0 => 12.2.0
    next-auth: ^4.7.0 => 4.7.0
    react: 18.2.0 => 18.2.0


npmPackages:
    @next-auth/prisma-adapter: ^1.0.3 => 1.0.3

Reproduction URL

https://github.com/juliusmarminge/stocks

Describe the issue

My app has 2 providers, Github and Discord and I am using the Prisma adapter for Next-Auth.

My Discord and Github accounts uses the same email, and in the schema the email has to be unique. (I have tried removing this constraint)

If I first sign in with Discord, then the Github sign in fails cause the user cannot be created in the DB (I guess that's why?). The same happens if first signing in using Github then Discord.

The main issue is I don't get any errors telling me what the issue is.

How to reproduce

Setup an app with two providers and the prisma adapter. Use the default prisma schema.

Have accounts ready for the different providers that has the same email registerred.

Sign in to one of the providers, then sign out and try signing in using the other provider.

Expected behavior

I am not sure how this should be handled. If it isn't possible to sign in to different providers where the email clashes, I expect an error so that I can tell the user to use an account with a different email.

[mohammed-bahumaish]

As mentioned in the FAQ

      Automatic account linking on sign in is not secure between arbitrary providers - with the exception of allowing users to sign in via an email addresses as a fallback (as they must verify their email address as part of the flow).
      
      When an email address is associated with an OAuth account it does not necessarily mean that it has been verified as belonging to account holder — how email address verification is handled is not part of the OAuth specification and varies between providers (e.g. some do not verify first, some do verify first, others return metadata indicating the verification status).

it's not secure, but you can make a fork and modify to your needs.
I have made a fork of next-auth to accept auto linking. I'm using only email and google sign in. so it's fine.

[vincent-thomas]

But if next-auth checks if the providers have authed the email, could it then sync the accounts?

[ThangHuuVu]

Hi @juliusmarminge 👋
This behavior is expected, thanks @mohammed-bahumaish for pointing to the FAQ 🙌

There are ongoing efforts to allow this behavior via a configuration, see #3557. You can continue the discussion from there.
I'm closing the issue since this isn't a bug in the NextAuth.js code.