Login with Twitter or Facebook - How to link accounts

Question

I've been developing a site and I've been trying to come up with a method to make sure all Social Network accounts of a certain user are linked together. I've had one snag from the start, and maybe someone here has an idea of what to do.

This is the problem. Let's say someone comes to my site and they click login with twitter.

My site

• creates an account (adds user to member database)
• adds twitter credentials to database for that user
• logs the user in

Now let's say this person logs out, and the next time they come to my site they login with Facebook.

My site

• checks member database for a user with the same email as the one sent from Facebook on authentication
• If there is no match, I create a user
• add Facebook credentials for that user

Here is where my problem comes in. Twitter does not send an email of the user on authentication. So my database and script, when someone logs in with Facebook after they've already logged in with Twitter previously, does not recognize the accounts should be linked and creates a whole new user.

Is the only possible way to keep track with cookies? Or am I mjust missing something in the logic of it?

Any ideas would be great.

By the way this is for a website, using php + mysql

---

Question update

---

Hey Demian,I took a look at edit logins and noticed they don't have a twitter option. My issue isn't when the user is already logged in, everything works great and connects the accounts. It's more like this.

Lets say a user logs in to my site for the first time with twitter. I give them a unique user ID in my "members" database table, then add their oauth credentials for twitter in my oauth table, linking it to their member ID.

\Now let's say a month goes by and a user comes back. This time, though, they login with Facebook. There is no way for me to tell which user they are in my database from their previous login with Twitter because I don't have that unique member ID to link it to.

That's why I'm thinking storing the unique member ID in a cookie is a good idea, but what if they delete the cookie?

Answer 1

Take a look at how StackExchange does it. Go to your profile page and click "edit logins" and follow that flow. Honestly, it seems to be the most reasonable of those that I've seen.

Essentially, you'll store a single user object in your database and add login providers (through a table with a FK perhaps) as your user chooses them. Now, when your user logs in with any of the providers, you know which distinct user (in your system) it represents.