Talk:LoginAndSecurity

Questions:

• the wireframes make it look like everything is modals, even 'edit profile'. it might be slightly easier to have 'edit profile' be a page instead of a modal. does it matter which way we do it?
• need a spec for the 'forgot password' process. what does the email say? also, i assume the email has a link to a 'reset password' page -- since this is going to just be an external link it will definitely be easier for it to just be a page instead of a modal...

• the 'change email if account is linked' is still a little confusing to me. this may be mostly edge cases, so it may not be worth worrying about, but i'm interpreting it thusly:

1. when a user logs in via 3rd party auth, we get some info from them:
   • email
   • remote user ID (i.e. their facebook or google userID)
   • auth source (e.g. facebook or google -- so we know the source of the user ID)
   • name

   if they change their facebook email/name and log in again, do we update our copy of their email/name?

2. (user ID + auth source) is what we should use as the unique ID in this case (currently we're using email, so i'll need to change that)
3. the user can do 'create password', which then will allow them access to the full version of the edit profile dialog

what happens if they now 'login with facebook' again before changing their email on our site? do we still update their local email/name?

Now the user changes their email in our system. can they still 'login with facebook'?

how do we know "no longer linked to Facebook until Facebook email address also changes" -- they try to log in again with facebook and now their email addresses match again?

am i overusing my question mark icon because i'm kind of proud of it?

--DaveSanderman (talk) 09:55, 25 May 2020 (PDT)

more questions:

"Must enter password (or authenticate in current session) when changing profile information"

• what's the UI for this? also, the current JWT-based model doesn't really have the concept of a "session" -- is it ok for now to just always require password when changing this info?