6

I have a basic user account system through which a user changes their profile picture, username, email and password.

enter image description here

If the user used social login to sign up, they wouldn't have a password in my app.

Concerns

  • A normal user of my app uses an email and password to sign up
  • A social login user of my app clicks a social login button such as Facebook, Google or Github at the time of signup and doesn't have a password
  • I thought that the whole point of social login was that the person doesn't have to enter a password
  • The problem for me starts when the user goes to their account page and tries to update their email
  • A normal user will have no trouble updating their email as they just need to re-enter their password

What do I do with a social login user? I can think of a few options:

  1. Disable update email functionality for social login users until they set a password (show them a link to create a password)
  2. Let them update their email but open a modal asking them to create a password
  3. Ask them to create a new different account with an email or password

Let's say you used abc@example.com to social login via Facebook; you don't have a password currently. For some reason, you want to change it to xyz@example.com

At the login screen, how will this user now log in without a password?

There is a chance that the new email xyz@example.com is coming from Facebook because the user opened their Facebook account and changed their email or the user just set it something else that is not used on any of their social accounts.

The user will not be able to login with xyz@example.com without using a password anymore.

How could I let such a user update their email through the Account page?

7
  • 1
    I am not sure what your problem is? Why can't you just let them change it like you do with any other field?
    – musefan
    Jun 14 at 16:25
  • 1
    @musefan dont you think you are letting a person update email without any sort of security measure? any normal email update flow asks for password confirmation
    – PirateApp
    Jun 15 at 10:05
  • 3
    Well, I assume the user is already authenticated at that point, but if your concern if getting a double-check, then you can require them to "re-authenticate" with the social provider again (if technically possible) once they make a change to the email. I also think there might be some confusion about why a password if often required when changing an email. It isn't simply about authenticating the change (although that is often a good reason), but as developer myself I can tell you that there are some times technical reasons why a password must be change at the same time as an email.
    – musefan
    Jun 15 at 10:59
  • 1
    It seems like there is some technical constraint to this particular question that determines the design solutions possible. Can you update the question to provide more details around potential constraints otherwise there is just going to be comments without solid answers.
    – Michael Lai
    Jun 20 at 23:35
  • 1
    @MichaelLai i have added more details, can you please unlock the question
    – PirateApp
    Jun 21 at 3:25
3
+50

EDIT: My initial answer got right into some ideas but it needs some introduction first:

As I commented below, it is my advice to take a step back and think about the reason why this problem exists in the first place, focus on the "why" rather than the "how". What is the e-mail address used for and why do users want to change it?

Also if you allow users to log in using multiple providers, you should also allow all kinds of e-mail addresses from different sources. Yes, someone who logs in using Facebook will probably do that again next time, but it is possible they choose Google instead.

My ideas below are based on some assumptions and possible additional problems and might not suit your needs. But it is based on the idea that you need the e-mail address for something and for that same reason people possibly want to change it. Instead of letting users change the address from the login provider to something that is suitable for that purpose allow setting an e-mail address specifically for that. If none is set, choose the one from the login provider.


Original answer:

Since you already offer authentication using different providers, you should give the same options to re-authenticate the user.

The only reason for re-authentication when changing the e-mail address is when the e-mail address is used for login. Allowing an alternative e-mail address for this in addition to the addresses obtained from other providers could solve your problem. The address taken from Facebook should be read-only but can be used for communication for example.

When the user fills in or changes the e-mail address and chooses to use it as login credentials, show a password field and prompt for re-authentication after submit. A simplified example with a modal:

enter image description here

When an e-mail and password were already previously set, it can be an additional option in the modal to re-authenticate by e-mail and password.

Allow options to choose which address is preferred.

enter image description here

When nothing is entered for "other" and Facebook is the only option, it shouldn't be possible to delete it. And when default is selected for the "other" field, that field is required.

enter image description here

Not sure if this fully covers it. If I missed something, please let me know in the comments.

4
  • I think you may have misunderstood my question, lets say user A signs up first time on my webapp with Facebook, they use an email abc@gmail.com. In my account page, I want to provide an option where A can update their email to say bcd@gmail.com. The problem is bcd@gmail.com could be their twitter email or it could be an email not connected to any social account. My question is how to let A update their email in this scenario? your answer seems to be related to linking social accounts like facebook and twitter together
    – PirateApp
    Jul 7 at 6:34
  • if A at the time of signup used a normal email password combination to signup, when they try to update their email I can ask them to enter their password to confirm but what do I do with social login guys
    – PirateApp
    Jul 7 at 6:36
  • 1
    Keep in mind the reason why you need the e-mail address and why users might want to change it. I don't think I did misunderstood the question but offered a solution where you always have an e-mail address and where you allow the user to freely change it. I call it the default e-mail address. When the user also wants to use it as a login e-mail address, that would be the only reason to ask for a password when it changes.
    – jazZRo
    Jul 7 at 10:24
  • 1
    I gave Facebook as an example, but you can add Twitter, Google e-mail addresses as well when the user logs in that way, and let users choose which one to use or enter a different e-mail address. It has nothing to do with linking social accounts.
    – jazZRo
    Jul 7 at 10:25
1

Even there isn't only a single way to do it right, it needs understanding your target user and make an assessment about evaluating which way is viable as an end-to-end solution for overall aspects.

What do I do with a social login user? I can think of a few options:

  1. Disable update email functionality for social login users until they set a password (show them a link to create a password)

Even it can be done the way you proposed, you should definitely not apply it, in order to keeping same features consistent alongside whole application.

  1. Let them update their email but open a modal asking them to create a password

Also it should be noted that social login users should also have the same features as well, like you stated within your question as cited below. But while opening that modal, keep in mind that putting the same feature to the exact same place for both social and e-mail login users is crucial.

  1. Ask them to create a new different account with an email or password

Applying the option you stated above should not be the case, instead letting user add an alternative e-mail to their existing account as @jazZRo described is thinkful though. Otherwise you're proposing a more complicated solution from user's perspective, that may lead to confusion anyway.

Lastly there's still probability of change for an email linked to existing social login option. Hence there's no one correct way for all approach exists. The options in this case are;

  • You may directly ask users after logged in, to define alternative e-mail/password option (hence the social login's advantage gone though),
  • 'Send a Password' button as a magic link can be shown where the exact same place with Change e-mail feature whenever it's tried to be used,
  • Risky but worth to try approach that is, if a user has a verified past social login with at least one logging, and then also has verified social login for the new e-mail address, it may succesfully redirects user as a granted login.
1

An email address is not an identity for a user, as email addresses can be changed almost everywhere on the web. Social login providers will have a unique token that identifies the user, which is what should be used to associate a successful social login on your site with a particular user profile (or if no existing profiles match, to create a new one).

So the answer to your question of how the login process should be affected by the user changing their email — whether on your site or on the login provider's site — is that it shouldn't be affected at all. The user should still be able to log in with the same social account without needing a password.

But there's a second function of the password for users who have one, which is that it's used to reauthenticate the user before allowing them to update their email, or other potentially dangerous operations. Use your best judgement as to whether reauthentication is necessary and if so, how stringent should it be — for example, reauthentication for a user with 2FA might only require one factor.

I don't think reauthenticating with the social provider is likely to offer much security because most people are already logged in to the social provider, which makes the process just a single click regardless of whether they're the real owner of the account.

If reauthentication is necessary, a better idea may be to send a temporary link to their old email address to verify that the person logging in controls that email account. If security isn't quite as important for your use case, it may be sufficient to allow the email address to be updated, but send a notification email to the old address letting them know of the change. Either way, it may also be a good idea to send a temporary link to the new email address to ensure any future emails are sent to someone who consented to receiving them, rather than some fake address.

You can try changing your email on Stack Exchange, in which case you'll see that it doesn't require reauthentication at all, just confirmation of the new email address using a temporary link.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.