System Information
-
Strapi Version: v4.5.5
-
Database: Postgres
To register in my application, the user just needs to enter an email address and password. Mail is automatically inserted into the user’s name. A new user is created in the strapi database with the same email address and username.
I want to add authorization through google
I’m add the Google provider in strapi for OAuth via Google.
Everything works and I can go through Google from the front-end application, but there is a problem:
google user authorization MY_NICK_NAME@gmail.com creates an account (if the user has not been created earlier)with a nickname in the strapi database MY_NICK_NAME and, accordingly, mail MY_NICK_NAME@gmail.com.
I decided to make the registration process in the strap identical to the one described above: I cut the mail to the @ symbol.
If later another user tries to register in the system at MY_NIC_NAME@rambler.com, then he will not be able to do this, because. if you cut the line with mail then:
MY_NAME_NAME@rambler.com
AND
MY_NIC_NAME@gmail.com
identical up to the @ symbol.
Is it possible to make the Google provider in the strap not cut out the mail in the bar, but save it in the username as it is?
those. so that the nickname when registering through Google is MY_NICK_NAME@gmail.com
I found a solution.
The identifier for authorization in the strap can be not only the login, but also the mail.
more: Users & Permissions - Strapi Developer Docs
Thus, I can not cut the mail before the @ symbol when registering, but perform standard authorization by mail.
I found another very, very serious bug. The provider does not compare mail when creating a record. Here’s what you can get:
Created 2 users with one mail. One user is created by the provider, the second - by standard registration.
This behavior is critical and can break the entire application. In the settings, I indicated that one user has one mail.
I would pass this discussion on to the developers. This is indeed a serious problem. in our applications, we often use mail to interact with users.
For myself, I see only one solution:
Truncate the mail of a user creating an account through standard registration to the @ symbol if he uses gmail.com
This is the only solution if you don’t want to mess with the inside of the strap.
The solution I provided above doesn’t work either. The provider absolutely does not care that a user with such a login already exists.
I’m shocked. Terrible behaviour.
This behavior renders this feature useless. this poses a risk of crashing the application
In the screenshot below, one user was created using standard registration, the second - by the provider
If you first create an account using the Google provider, and then try to use the same mail with standard registration, then everything is fine. Strapi will refuse, since there is already a record with such mail, but the provider ignores these rules, which means that if we first create an account using standard means, and then authorize the provider’s Google with the same mail, we will get a new account with the same login and mail.
This is very, very wrong.
