You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Create django model with USERNAME_FIELD set as email
Create user with some email
Try to log in via social auth under the user with the same email
Expected behaviour
AuthForbidden should be raised, because originally this user was not created via social auth
Actual behaviour
User is being logged in
Looks like if username field for the model is email then user will be logged in by this email even though it may be unsafe as it was mentioned in associate_by_email pipeline's docs
Ways to reproduce
USERNAME_FIELD
set asemail
Expected behaviour
AuthForbidden
should be raised, because originally this user was not created via social authActual behaviour
User is being logged in
Looks like if username field for the model is
email
then user will be logged in by this email even though it may be unsafe as it was mentioned inassociate_by_email
pipeline's docsIs this an expected behavior?
https://github.com/python-social-auth/social-app-django/blob/master/social_django/storage.py#L91
The text was updated successfully, but these errors were encountered: