title: Potential security issue with Facebook login?
body: <p>I am currently implementing Facebook Login on my website for the first time and I have some doubts on how secure this is.</p>
  
  <p>I already have a database with users and for each one of them, I store an email address, so I really need to check whether an email address I get from Facebook is already present in my database or not, otherwise I would have some problems with duplicate users. If a user is already present, I simply merge data from Facebook into the existing account on my website and I connect the user. Otherwise, I create an account for him.</p>
  
  <p>But here is the thing:</p>
  
  <ol>
  <li><p>Alice connects on my website using email address <em>alice@users.com</em> but <strong>Alice is not registered on Facebook</strong> with that email address</p></li>
  <li><p>Bob registers on Facebook using Alice's email address <em>alice@users.com</em> and verify the account using an SMS received on any phone number (I checked and this is possible, an account can be verified without clicking on the link received by email). I agree that Alice would be notified on her email address but still, this is possible.</p></li>
  <li><p>Bob triggers login on my website using facebook connect, while being connected on Facebook using Alice's email address.</p></li>
  <li><p>Bob's Facebook account is active and verified, and I have to assume he already has an account on my website as <em>alice@users.com</em> is already in my database, so I connect him instead of Alice and he can use my website on Alice's account.</p></li>
  </ol>
  
  <p>=> I tried this scenario on several websites and I could connect on someone else's account (a fake Facebook account that I created ;) ), as long as I knew the email address.</p>
  
  <p>Does anyone have an idea on how to prevent these situations?</p>