[RFC] Login with email

[callumacrae]

I propose that users should be allowed to log in with either their username or their email address, similar to how this modification does it.

This doesn't really have many advantages, but it doesn't have any disadvantages, either. I've seen a few people request it, and I can see why it could be useful, so why not?

[DavidIQ]

Seeing that most other major auth systems are going with this model, i.e. Facebook, Twitter, etc., I like the idea. +1 from me.

[callumacrae]

In order for this RFC to be possible, we would have to disallow email address reuse. Does anyone actually use it?

[Senky]

to add some ideas:

Disadvantage:
currently, user can be named as email (for example "[email protected]" is valid username - BUT also valid email). This may be problematic, when someone registers with username matching your email.

To fix this, you will need to make some installation script checking usernames and emails - list conflicts and let admin decide, whether to delete/edit usernames, or emails.
Or it needs more ideas, what to do with conflicts...

[jsebean]

In order for this RFC to be possible, we would have to disallow email address reuse. Does anyone actually use it?

I'm all for that, what's the point anyway. I mean it's a bit convienient for developers and people testing on a local install, but why not just use [email protected] as an email when testing

Only problem is, what about conversion of an older board, if there are multiple users on a board with the same email, there are gonna be conflicts.

to add some ideas:

Disadvantage:
<span>currently, user can be named as email (for example "<a class="linkclass" href="mailto:[email protected]">[email protected]</a>" is valid username - BUT also valid email). This may be problematic, when someone registers with username matching your email.</span>

To fix this, you will need to make some installation script checking usernames and emails - list conflicts and let admin decide, whether to delete/edit usernames, or emails.
Or it needs more ideas, what to do with conflicts...

That's not a problem is it? If someone wants to do that why not... You would have two matches, it would check to see if it matches the username, if matched then check password and login, if no match check the email, if matched, check the password and login. If no match, the of course you can't login If the email address and username is the same and it matches the when it checks username first they it don't matter.


Edit:. I see a bug in phpBB when I quoted it put in the HTML of that post.

[callumacrae]

Only problem is, what about conversion of an older board, if there are multiple users on a board with the same email, there are gonna be conflicts.

Yeah. I'm thinking that it would need a config option for login with email, and if there are multiple users with the same email, refuse to enable it.

That's not a problem is it? If someone wants to do that why not... it only might make it a bit more tricky on the code side of things since it would find two matches, but they would be the same account so it would work.

It wouldn't work if they were different accounts, which (currently) is possible.

I would suggest disallowing valid email addresses as usernames, but then we've got the same problem with upgrades and conversions.

[jsebean]

That's not a problem is it? If someone wants to do that why not... it only might make it a bit more tricky on the code side of things since it would find two matches, but they would be the same account so it would work.

It wouldn't work if they were different accounts, which (currently) is possible.

I would suggest disallowing valid email addresses as usernames, but then we've got the same problem with upgrades and conversions.

You quoted me before I got a chance to edit... I gotta use the preview button more often

[jsebean]

It wouldn't work if they were different accounts, which (currently) is possible.

True.

I would suggest disallowing valid email addresses as usernames, but then we've got the same problem with upgrades and conversions.

True.

This is a neat idea but might not be practical the way phpBB is made. Maybe instead of using email, use the normal username, then use a seperate display name a user can choose, adds a little more security for bots trying to brute force an account, which is one advantage of using email for login. Though, if you allowed both username and email login the of course there's no advantage other than if a user forgot their username.

[Oleg]

This doesn't really have many advantages, but it doesn't have any disadvantages, either. I've seen a few people request it, and I can see why it could be useful, so why not?

You answered your own question there.

[naderman]

It does have one advantage: it solves the "forgot my username" problem.