I had a lot of trouble implementing social logins the other day so it's not completely painless either. For example if you have multiple social logins, what do

I had a lot of trouble implementing social logins the other day so it's not completely painless either. For example if you have multiple social logins, what do you do if the user forgets which account(e.g., google or facebook) they used? You could just let them login with any as long as the email matches. But then what if you have a social login type that doesn't require verified email? For example let's say you add an imgur login but the user doesn't have an already have an account there. Then an attacker can just create the imgur account with that unverified email and then use that to log into the same email on your site. There's also a bunch of edge cases with handling users who use different emails for different social accounts so you can't assume one-to-one correspondence between email address and users anymore. And there's a bunch of other issues with how to initialize a good default display name from these different social profiles. And also the issue with how to handle if they unlink all their social login methods. And how/who to send reset password. And so on and so forth. In the end this was all too hard and I gave up and only allowed logging in with google and google only. Which kind of sucks.