Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'm planning to utilise a third party authorisation service in order to allow users to sign in with their google/facebook accounts etc.

In particular I am aiming to use the Yii extension here-

http://www.yiiframework.com/extension/hybridauth/

I am uncertain of one point, however, and I'm hoping to clear this up before investing time into implementing this. How will I email a user? Are there third part API functions that I can use for this that vary between third party providers?

It occurs to me that this must be the same for the StackExchange network as I frequently receive email from the site and only sign in with my google credentials. However, upon checking my profile I can see my email address is listed, so I'm no longer sure.

Is anyone able to confirm how this works? If no-one is aware I will test this by registering a new account solely through google and check for emailed notifications.

share|improve this question

migrated from webapps.stackexchange.com Jun 5 '13 at 12:02

This question came from our site for power users of web applications.

1 Answer 1

up vote 0 down vote accepted

Both OpenId and OAuth (the most widely used remote login schemes) send the email address of the user to the site upon successful login.

I implement both OpenId and OAuth on my website. I use OpenId for Google and OAuth for Facebook (which doesn't support OpenId). When the user logs in, I examine the data I get back from the login provider. This data comes in URL parameters. I store that information (including email address) in the database at that point. Here is a question that I asked that shows what data is available to you when a user logs in using either OAuth or OpenId: http://stackoverflow.com/questions/15816359/what-data-can-be-obtained-about-a-user-who-logs-in-with-facebook-oauth

share|improve this answer
    
Thanks for this. Out of interest, what would you regard as the best practice for letting the user see what info you retain of theirs? For instance, do you show the user that you've got their email address and, or is it just assumed that by granting access to their openID you are permitted to use this info? –  goose Jun 6 '13 at 7:48
    
I use Google for the login provider for OpenId. When you first sign into a site using Google OpenId, Google explicitly tells the user what info it is sharing and asks if it is OK. –  Stephen Ostermiller Jun 6 '13 at 10:26
    
Got it, thanks! –  goose Jun 6 '13 at 12:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.