jfweller@web.de's avatar

Socialite user registration. What to do with password field

Hi, I have setup Socialite and allow my end-user to register via Facebook. In that case I don't have a password associated to the user. I wonder what you guys did. Do you create a fake password and safe it with the user record or did you change the password field to nullable() and left it empty? Thanks!

0 likes
8 replies
mahmoud_eid's avatar

When you use registration or login via social media you don't need password field because it's not required at tis case so you can left it empty (NULL) . On other hand some people after finish registration via social networks they redirect to other form and let user set his password, so if user in next time like to login via social like Facebook we will not ask him to enter password, otherwise maybe he will login via his email that we already have from social media registration API and in this case he should enter his password.

abhishek009's avatar

No need to store password.

Basic work flow as I understand.

If user is new to website, sign up using facebook and store his facebook ID in datatabse with his/her Name , avatar , gender etc. and perform some other option for new user.

When that user comes again, search for the ID in database and log that use in.

axtg's avatar

Hi,

Just to inform others of what I did here for their considerations.

  • Yes, I set password to nullable()
  • In the socialite flow, a user will never need a password
  • In the 'my account' a user can set a password, leaving the current password empty (@if directive in Blade based on password value)
  • Once the password is set, a socialite user can login via both social media or direct

Looking at my own behaviour, I felt this is the most user friendly thing to do.

My two-cents.

XG.

7 likes
capten_masin's avatar

I realise this is an old post but it's been helpful with sorting out my own Socialite flow Going with the nulled password approach, how would you handle an action that requires a password confirmation?

TheGingerDog's avatar

@capten_masin I just removed the requirement for a password confirmation.

I guess you could compare how recently the user had auth'ed via socailite and use request reauth if necessary? somewhat more clunky though.

Please or to participate in this conversation.