nextauthjs / nextauthjs/next-auth

OAuthAccountNotLinked Error when using different provider accounts with same email as EmailProvider

Open
#7,901 6 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

triage
Dominant language
TypeScript
Stars
28.4k
Forks
4k
PR merge metrics
No merged PRs in 30d

Description

Environment

System:
OS: Windows 10 10.0.22621
CPU: (16) x64 Intel(R) Core(TM) i9-10885H CPU @ 2.40GHz
Memory: 2.26 GB / 15.75 GB
Binaries:
Node: 18.15.0 - C:\Program Files\nodejs\node.EXE
npm: 9.5.0 - C:\Program Files\nodejs\npm.CMD
Browsers:
Edge: Spartan (44.22621.1848.0), Chromium (114.0.1823.58)
Internet Explorer: 11.0.22621.1

Reproduction URL

https://github.com/dlamprey/nextauth

Describe the issue

Authentication with third-party providers such as Google and Facebook does not work if those accounts have the same email as previously authenticated using the EmailProvider. An error is displayed:

image

How to reproduce

├─┬ @next-auth/mongodb-adapter@1.1.3
│ └── next-auth@4.22.1 deduped
└── next-auth@4.22.1

With these providers: EmailProvider, GoogleProvider (or FacebookProvider, not in sample code)

  1. Start with a clean database (I used MongoDB)
  2. Login using EmailProvider (magic link) using an email address that is associated with your Google account
  3. Log out (not required to duplicate the issue)
  4. Login using Google with the account having the same email address as used in step 1.
Expected behavior

No error. A user with the same email address associated with different providers should be able to use any combination of providers to login. I would expect a separate user record to be created for each provider for such a user (regardless of there being a common email address. I do not expect the accounts be linked - just work independently.

Use Case that DOES Work:

  1. Start with a clean database (I used MongoDB)
  2. Login using Google
  3. Log out
  4. Log in using the EmailProvider using the email address associated with the Google account used in step 1.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the flow with EmailProvider followed by GoogleProvider using the linked reproduction and a clean MongoDB database. Trace the provider-account and user lookup behavior responsible for OAuthAccountNotLinked, then verify that the selected same-email provider combinations follow the project's intended account-linking policy without producing the error.

Written by the indexing model from the issue text.

Assessment

Tech stack
nextjs, typescript
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.