What should happen if a social login user tries to reset their password?

Question

• On my webapp, I have normal users who signup with email/password combination
• I also offer signup via Facebook, Google, Twitter...
• Let's say you are a social login user who logged in via Facebook on my webapp using [email protected] as the email (from facebook)
• Now you come to my login page and go to Forgot password
• You type [email protected] in this box
• What should happen?

Possible Scenarios

• It gives you an error saying you logged in via Facebook
• It does a backend check to see if you ever used a password on the webapp before, if yes it takes you to the next step, if no it gives you an error
• It will take you to the next step anyways. Behind the scenes it will create a password based account for you separate from your social account so that you can login via Facebook or email/password combination

Answer 1

When you enter an email on the "forgot password" page, there should be a message saying something like "Thanks! If there's an account associated with this email, we'll send the password reset instructions immediately."

Then, your receive an email with a text explaining the you used social login.

Example form Optimal Workshop: "You recently requested your password to be reset.

You used your Google account to sign up to Optimal Workshop. This means you didn't need to set a password when you first signed up. To sign in to your account, all you need to do is click "Log in with Google" on the log in page.

Still having trouble logging in? Contact support"

Hope this solves your problem!