验证通过 Oauth 进行身份验证的用户
我已经为我正在开发的应用程序提供了 Oauth 支持。我正在尝试解决的是关联 Oauth 帐户的逻辑。
例子：
假设用户之前已经登录过。他们使用 Facebook 进行身份验证。我现在有了一个电子邮件地址，我可以放心地假设该地址对于该用户来说始终是唯一的。但是，Twitter 不通过其 Oauth 实现提供电子邮件地址，因此如果有人先使用 Twitter 登录，然后使用 Facebook 登录，我如何正确关联他们的帐户？我无法使用用户名或处理程序，因为显然这可能因提供商而异。还有其他方法可以做到这一点吗？
如果用户使用省略电子邮件地址的 Oauth 提供商，我是否要求用户输入电子邮件地址？我正在努力将最好的用户体验和最稳定的系统结合在一起 - 因此非常感谢您的帮助。
I've got Oauth support in place for an app I'm working on. What I'm trying to work through is the logic for associating Oauth accounts.
Example:
Let's say a user has logged in before. They authenticated using Facebook. I now have an email address which I can safely assume will always be unique to that user. However, Twitter does not provide email addresses through its Oauth implementation, so if someone signs in with Twitter, and then Facebook, how do I correctly associate their account? I can't use user name, or handler, because obviously that could vary per provider. Is there any other way I could do this?
Do I require the user to enter their email address if they use an Oauth provider which omits it? I'm trying to put together the best user experience and the most stable system - so your help is highly appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您正在考虑与多个身份提供商合作，那么最好的解决方案是使用系统唯一的内部 ID，然后在进行外部身份验证时将外部帐户与该 ID 相关联。此外，FB 中的用户可以更改他们的主要电子邮件地址，因此可以安全地假设它是唯一的，但假设它是最新的可能不安全。
If you're looking at working with multiple identity providers then your best solution would be to use an internal ID unique to your system and then associate the external accounts with that ID when the external authentication takes place. Additionally users in FB can change their primary email address so it would be safe to assume it's unique it's probably not safe to assume that it's current.