-
Notifications
You must be signed in to change notification settings - Fork 4k
Add opt-in for dangerous linking #5513
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add opt-in for dangerous linking #5513
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 1 Ignored Deployment
|
|
The original PR does not seem to be closed, but due to inactivity, it might be in the future. I closed it and pointed to this PR, hopefully, the author will understand. |
3bf7bc6 to
885e01a
Compare
|
We have rebased the PR so that there is no longer a conflict with main branch. Hopefully we can get this one approved since account linking seems to have come up fairly frequently. |
ThangHuuVu
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for sending the PR 🙌 Could you run the linter on the PR again? Let's get this merged soon
885e01a to
5e56e15
Compare
I'm are running into some difficulties running the linter! Not sure how to fix it as this is our first time working with mono repo. We're getting this error when running the linter. Any ideas how to resolve this? (I suspect we just haven't set up something correctly) EDIT: Never mind. Instead of trying to build this locally, we just looked at the Github Actions pull request output and noticed that it was calling the lint command anyways. After rebasing the code onto main branch again, we noticed that there was a linting error that was breaking the build (not due to our changes though). So in order to complete the linting, we added a fix for the linting error. There should no longer be any outstanding issues with lint. |
ThangHuuVu
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
This is an updated pull request of #3557 since it was closed due to inactivity. We also have the same use case as the original author (@Gregoor).
@ThangHuuVu I've updated the pull request against the latest main branch so that it compiles, and I have also addressed the requested changes from the original pull request:
allowDangerousEmailAccountLinkingoption was moved toOAuthConfigsince it only applies to oauth providers.☕️ Reasoning
By default account linking can only be done through an active session, to prevent account stealing from low-trust providers. Some next-auth users might trust their chosen providers enough to opt them into more lax account linking.
🧢 Checklist
🎫 Affected issues
#3557
#5098
#5324
#4826
#4625
#4271