v1.2.31Web App
•1 min read

Explicit Google OAuth Sign-In and Registration Separation

AuthenticationOAuthGoogle Sign-InSecurityWeb App

Separated Google OAuth authentication flows to enforce explicit intent: preventing unintended account creations during sign-in when no profile exists, and blocking duplicate registrations when an account is already registered.

#Explicit Google OAuth Sign-In and Registration Separation

This release improves authentication security and intent clarity when authenticating with Google:

  • Sign In Intent Protection: Attempting to sign in with Google when no account exists will no longer automatically create an account in the background. Users are informed clearly that no account was found and guided to register.
  • Sign Up Duplicate Prevention: Attempting to sign up with Google when an account is already associated with that email will prevent duplicate account creation and prompt the user to sign in directly.
  • Dedicated Flow Verification: Uses verified client intent markers and server-side decision handlers (evaluateGoogleSignInDecision) with comprehensive test coverage.