I am scared that someone can get into anybodys account on my game, if user does not have Facebook. Stealer makes facebook with same email that user in my game, and then click "Login with facebook" -> redirects him to permission page -> back to my page - it detects that facebook email is same as victim's and -> stealer is logged into victims account.
How could I prevent this? Just t allow LOGGED in users to associate their account with facebook's ?