[Django]-For some reason google oauth2 can signup into same user with different gmail emails

by

0👍

✅

Got an answer from @omab himself
https://github.com/python-social-auth/social-core/issues/232

if the user doesn’t logout from your app, and then proceeds to login with the second GSuit account, then the new social account is associated to the currently logged in user. If you want to enforce separated accounts, then you need to force that no user is currently logged in in your site.

👤Sardorbek Imomaliev

3👍

The issue seems to be with associate_by_email config in the pipeline.
Removing that config would create a new user for all new social logins.

According to the doc:

if a user signed up with his Facebook account, then logged out and
next time tries to use Google OAuth2 to login, it could be nice (if
both social sites have the same email address configured) that the
user gets into his initial account created by Facebook backend.

Read more here: http://python-social-auth.readthedocs.io/en/latest/use_cases.html#associate-users-by-email

👤scene_contra

Leave a comment