"User is already registered with this e-mail address."

Trying to implement a FB login flow. I upgraded to v.0.9.3 because I thought it fixes the bug where you are already signed up via email. However, it now seems that the code knows the user is registered but doesn’t sign him in anyway. I am getting the access_token just fine from FB. I have tried both the /rest-auth/facebook/ and /rest-auth/facebook/connect/ endpoints, although not quite understanding the difference. At any rate, they are both resulting in the same 400 error.

[maxim-kht]

Thank you @philippeluickx, yes it is implemented in the latest version by @aleksihakli and can be used via /rest-auth/facebook/connect/ view.

@EvanZ The difference between /rest-auth/facebook/ and /rest-auth/facebook/connect/ is, connect view only works after you logged in as a regular user via email and you wish to attach social account to this existing user. Here’s more info in the docs: http://django-rest-auth.readthedocs.io/en/latest/installation.html#additional-social-connect-views.

In order to use social connect view you need to

1. Login as existing user (registered before as a non-social account)
2. Access /rest-auth/facebook/connect/ to attach social account to this existing user.

[EvanZ]

At least with FB, they tell you whether an email is verified or not. If they say it is verified, my understanding is that is a guarantee they verified it. I don’t know about how other social providers do it. From my perspective, it would make more sense to enable the library users to “trust and verify” the social auth providers that they use, and not force one way of thinking, but it is not my project, so not my choice to make. I understand now the security issue, which is important, and the tradeoffs. I will continue using this library because there really aren’t any good alternatives from what I’ve seen, and I don’t want to reinvent the wheel at all. Thanks for all your efforts!