Freecodecamp: Login issue: changing the email is not case-sensitive and leads to duplicate accounts

[WofWca]

Describe the bug
__TL;DR__ – first signed up with GitHub (which has _email # 1_ set as primary). Lately changed the email on FCC to _email # 2_ and since then unable to log in using any of the available methods.

I have two emails:

1. @gmail.com
2. other.domain

On GitHub, I have the first one as a primary email and the second one as a secondary.
IIRC, I first signed up to FCC with GitHub, so the letters were going to my first email.

Then I set my email at FCC to the second one and this is where the fun begins.

What happens when I try to log in using different methods:

| Method | Account |
| ------------- |----------------------|
| with GitHub| newly created account # 1 |
| with email # 1| newly created account # 1 |
| with email # 2| newly created account # 2|
| with Google| newly created account # 1 |

As you can see, no method allows me to log into my original account.

Email bindings shown in each of the accounts:

| Account | Bound email |
|------------------|-------------------|
|original account| email # 2|
|newly created account # 1| email # 1|
|newly created account # 2| email # 2|

My session cookie is still present in one of the browsers and when I try to change the email back to # 1, it says that it is already bound to another account, which is fair enough.

[WofWca]

Does something need to be clarified?
It's not a "Help" issue, it's a bug report.

[moT01]

What if you try to change your account #1 email to some other email - then go to the browser that's still logged in with the original account, and change the email back to email #1 - or if you're still logged in on a browser with your original account, maybe change the email to a new email and see if that will allow you on to your original account. It doesn't get to the root of the problem, but it may get you back on to your original account.

@freeCodeCamp/dev-team

[raisedadead]

Hi @WofWca

Thanks for your report.

Can you send me an email mrugesh at freecodecamp dot org with details of your emails.
I'll fix up your account, and investigate the root cause and possible fix there on.

[WofWca]

@moT01 I no longer have this session.
@raisedadead I've sent an email, the subject is as the name of the issue.

[raisedadead]

I can see that we indeed have two accounts for each of your emails listed in the email. For all intents and purposes, we only use email as the primary identifier of your account.

So, it literally depends on what a provider returns us as an email address to lookup and sign you into the account.

For example:

First email: [email protected]
Changed email: [email protected]

Scenario 1:

• When you sign-in through email, you must use your changed email "[email protected]", using the old email will indeed create a new account for "[email protected]".
• We do not track old emails per account as a measure of privacy.

Scenario 2:

• When you sign-in through social providers like GitHub, they should be returning us the changed email, or indeed it will simply create a new account for the email they returned to us.
• We do not bind email to social provider again for privacy reasons.

Essentially by design, we will create or return an account as per the authentication method used.

[WofWca]

Well, the thing is – there are now three accounts. The original one is this one.

[raisedadead]

Okay, I found the issue. Thanks for the additional information. This indeed is a validation bug, when someone changes email.

So, when you entered your email on the update form in settings:

You entered something like: [e-mail], this was stored on our DB as is without sanitising it to lowercase. And the providers will always return lowercase emails. We unfortunately treated this incorrectly.

If you are okay, I am going to delete your 'new accounts' and restore the email that you intended as per the change lower-cased, which should give you access back to your original account.

As for the fix, I'll audit the code and get back to you.

[WofWca]

If you are okay, I am going to delete your 'new accounts'

I don't use them, so yeah.

[raisedadead]

@WofWca thanks for confirming, I have updated the email to be lowercased on your original account and removed the new accounts. Can you test this and let me know, if it's all fixed.

[WofWca]

Yep, it's working.

[Bouncey]

The fix for this is dependent on #36776