nextauthjs / nextauthjs/next-auth
OAuthAccountNotLinked Error when using different provider accounts with same email as EmailProvider
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 28.4k
- Forks
- 4k
- PR merge metrics
- No merged PRs in 30d
Description
Environment
System:
OS: Windows 10 10.0.22621
CPU: (16) x64 Intel(R) Core(TM) i9-10885H CPU @ 2.40GHz
Memory: 2.26 GB / 15.75 GB
Binaries:
Node: 18.15.0 - C:\Program Files\nodejs\node.EXE
npm: 9.5.0 - C:\Program Files\nodejs\npm.CMD
Browsers:
Edge: Spartan (44.22621.1848.0), Chromium (114.0.1823.58)
Internet Explorer: 11.0.22621.1
Reproduction URL
https://github.com/dlamprey/nextauth
Describe the issue
Authentication with third-party providers such as Google and Facebook does not work if those accounts have the same email as previously authenticated using the EmailProvider. An error is displayed:
How to reproduce
├─┬ @next-auth/mongodb-adapter@1.1.3
│ └── next-auth@4.22.1 deduped
└── next-auth@4.22.1
With these providers: EmailProvider, GoogleProvider (or FacebookProvider, not in sample code)
- Start with a clean database (I used MongoDB)
- Login using EmailProvider (magic link) using an email address that is associated with your Google account
- Log out (not required to duplicate the issue)
- Login using Google with the account having the same email address as used in step 1.
Expected behavior
No error. A user with the same email address associated with different providers should be able to use any combination of providers to login. I would expect a separate user record to be created for each provider for such a user (regardless of there being a common email address. I do not expect the accounts be linked - just work independently.
Use Case that DOES Work:
- Start with a clean database (I used MongoDB)
- Login using Google
- Log out
- Log in using the EmailProvider using the email address associated with the Google account used in step 1.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the flow with EmailProvider followed by GoogleProvider using the linked reproduction and a clean MongoDB database. Trace the provider-account and user lookup behavior responsible for OAuthAccountNotLinked, then verify that the selected same-email provider combinations follow the project's intended account-linking policy without producing the error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nextjs, typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100