3 ms·

Apple deviated from OpenID Connect, but... The third party is not supposed to link the information from an OpenID Connect client system by email address, which

by dwaite 6y ago

Apple deviated from OpenID Connect, but... The third party is not supposed to link the information from an OpenID Connect client system by email address, which could change or go away at any time, and is also not guaranteed to be unique. Rather, they should use the 'sub' claim which is meant to be the same over the lifetime of the user account with the issuer.

hirsin 6y ago
Yup, this is it. It's a super common issue though, and we see it all the time. An app expected the email of a user to be static and keys off of it. User gets married and loses their code access. At best it's a work stoppage when someone changes their email. At worst you make assumptions about reusability of emails and give data access to the wrong account.