Social Login
Letting users sign in with an existing account from a provider like Google or Apple, usually over OIDC. Reduces signup friction but ties accounts to third-party providers.
Social login raises conversion measurably and creates a dependency worth understanding: account recovery, email changes, and provider policy shifts now happen outside your control, and a user who loses the upstream account may lose yours. Support at least one path that does not depend on a third party, and never key your user records solely on an email address the provider can change.
See also: OpenID Connect, what is CIAM, progressive profiling, CIAM vendors
Related on Start with Identity
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- GlossaryConsent Management
Capturing, storing, and honoring user consent for data processing and communications, often to satisfy GDPR and similar laws. Central to customer identity and p
- GlossaryIAM
Identity and Access Management. Workforce identity for employees, contractors, and partners. Covers authentication, authorization, lifecycle, and audit. Distinc
- CVEKeycloak session hijack via prompt=login re-authentication
Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Pa
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEOpenID private_key_jwt audience ambiguity
The OpenID Connect twin of CVE-2025-27371. private_key_jwt audience is ambiguous at the spec layer, so a client assertion can be replayed across authorization s