Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am scared that someone can get into anybodys account on my game, if user does not have Facebook. Stealer makes facebook with same email that user in my game, and then click "Login with facebook" -> redirects him to permission page -> back to my page - it detects that facebook email is same as victim's and -> stealer is logged into victims account.

How could I prevent this? Just t allow LOGGED in users to associate their account with facebook's ?

share|improve this question
up vote 3 down vote accepted

OpenID requires the user to be logged into the website of the OpenID account they are using. So unless someone is logged into that Facebook account, Facebook won't authenticate them and allow them to be logged into your website. So if someone uses the same email address as another person's Facebook account they will still fail to login.


Facebook does require the verification of email addresses so this kind of hijacking attempt will not work.

share|improve this answer
sorry, by "openID" I meant ALL services which provides fast-login API. So, I'm talking about facebook only – genesis Jun 18 '11 at 13:45
My answer applies to any OpenID provider, including Facebook. – John Conde Jun 18 '11 at 13:46
I didn'T get it. Facebook requires logged to be facebook account, right? But when comeone creates fake account with same email as registered in my DB, he would be able to log in. Or ? – genesis Jun 18 '11 at 13:48
If someone creates a fake account with the same email they would not be able to login. Just having the same email address is not enough. They must also log into Facebook successfully to pass the OpenID authentication. Obviously they won't know the Facebook password for that account and thus will fail authentication and will not be logged into your website. – John Conde Jun 18 '11 at 13:49
I think you didn'T get me. Example: You're my victim, you do not have facebook and I know your mail is foo@bar.com (on my site) -> I will create facebook account -> mail foo@bar.com -> does facebook require activate? (maybe that's the point) -> if no, login to facebook -> go to my one-click login app -> user is logged on my email .. so, does facebook require activation? – genesis Jun 18 '11 at 13:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.