How to let the user update their email if they used a social login?

Question

I have a basic user account system through which a user changes their profile picture, username, email and password.

If the user used social login to sign up, they wouldn't have a password in my app.

Concerns

• A normal user of my app uses an email and password to sign up
• A social login user of my app clicks a social login button such as Facebook, Google or Github at the time of signup and doesn't have a password
• I thought that the whole point of social login was that the person doesn't have to enter a password
• The problem for me starts when the user goes to their account page and tries to update their email
• A normal user will have no trouble updating their email as they just need to re-enter their password

What do I do with a social login user? I can think of a few options:

1. Disable update email functionality for social login users until they set a password (show them a link to create a password)
2. Let them update their email but open a modal asking them to create a password
3. Ask them to create a new different account with an email or password

Let's say you used [email protected] to social login via Facebook; you don't have a password currently. For some reason, you want to change it to [email protected]

At the login screen, how will this user now log in without a password?

There is a chance that the new email [email protected] is coming from Facebook because the user opened their Facebook account and changed their email or the user just set it something else that is not used on any of their social accounts.

The user will not be able to login with [email protected] without using a password anymore.

How could I let such a user update their email through the Account page?

Answer 1

EDIT: My initial answer got right into some ideas but it needs some introduction first:

As I commented below, it is my advice to take a step back and think about the reason why this problem exists in the first place, focus on the "why" rather than the "how". What is the e-mail address used for and why do users want to change it?

Also if you allow users to log in using multiple providers, you should also allow all kinds of e-mail addresses from different sources. Yes, someone who logs in using Facebook will probably do that again next time, but it is possible they choose Google instead.

My ideas below are based on some assumptions and possible additional problems and might not suit your needs. But it is based on the idea that you need the e-mail address for something and for that same reason people possibly want to change it. Instead of letting users change the address from the login provider to something that is suitable for that purpose allow setting an e-mail address specifically for that. If none is set, choose the one from the login provider.

---

Original answer:

Since you already offer authentication using different providers, you should give the same options to re-authenticate the user.

The only reason for re-authentication when changing the e-mail address is when the e-mail address is used for login. Allowing an alternative e-mail address for this in addition to the addresses obtained from other providers could solve your problem. The address taken from Facebook should be read-only but can be used for communication for example.

When the user fills in or changes the e-mail address and chooses to use it as login credentials, show a password field and prompt for re-authentication after submit. A simplified example with a modal:

When an e-mail and password were already previously set, it can be an additional option in the modal to re-authenticate by e-mail and password.

Allow options to choose which address is preferred.

When nothing is entered for "other" and Facebook is the only option, it shouldn't be possible to delete it. And when default is selected for the "other" field, that field is required.

Not sure if this fully covers it. If I missed something, please let me know in the comments.

Answer 2

Even there isn't only a single way to do it right, it needs understanding your target user and make an assessment about evaluating which way is viable as an end-to-end solution for overall aspects.

What do I do with a social login user? I can think of a few options:

1. Disable update email functionality for social login users until they set a password (show them a link to create a password)

Even it can be done the way you proposed, you should definitely not apply it, in order to keeping same features consistent alongside whole application.

2. Let them update their email but open a modal asking them to create a password

Also it should be noted that social login users should also have the same features as well, like you stated within your question as cited below. But while opening that modal, keep in mind that putting the same feature to the exact same place for both social and e-mail login users is crucial.

3. Ask them to create a new different account with an email or password

Applying the option you stated above should not be the case, instead letting user add an alternative e-mail to their existing account as @jazZRo described is thinkful though. Otherwise you're proposing a more complicated solution from user's perspective, that may lead to confusion anyway.

Lastly there's still probability of change for an email linked to existing social login option. Hence there's no one correct way for all approach exists. The options in this case are;

• You may directly ask users after logged in, to define alternative e-mail/password option (hence the social login's advantage gone though),
• 'Send a Password' button as a magic link can be shown where the exact same place with Change e-mail feature whenever it's tried to be used,
• Risky but worth to try approach that is, if a user has a verified past social login with at least one logging, and then also has verified social login for the new e-mail address, it may succesfully redirects user as a granted login.

Answer 3

An email address is not an identity for a user, as email addresses can be changed almost everywhere on the web. Social login providers will have a unique token that identifies the user, which is what should be used to associate a successful social login on your site with a particular user profile (or if no existing profiles match, to create a new one).

So the answer to your question of how the login process should be affected by the user changing their email — whether on your site or on the login provider's site — is that it shouldn't be affected at all. The user should still be able to log in with the same social account without needing a password.

But there's a second function of the password for users who have one, which is that it's used to reauthenticate the user before allowing them to update their email, or other potentially dangerous operations. Use your best judgement as to whether reauthentication is necessary and if so, how stringent should it be — for example, reauthentication for a user with 2FA might only require one factor.

I don't think reauthenticating with the social provider is likely to offer much security because most people are already logged in to the social provider, which makes the process just a single click regardless of whether they're the real owner of the account.

If reauthentication is necessary, a better idea may be to send a temporary link to their old email address to verify that the person logging in controls that email account. If security isn't quite as important for your use case, it may be sufficient to allow the email address to be updated, but send a notification email to the old address letting them know of the change. Either way, it may also be a good idea to send a temporary link to the new email address to ensure any future emails are sent to someone who consented to receiving them, rather than some fake address.

You can try changing your email on Stack Exchange, in which case you'll see that it doesn't require reauthentication at all, just confirmation of the new email address using a temporary link.