Bypass signup form using allauth

Question

Does anyone know how I would go about bypassing the signup page when using a social account in django allauth? I've got the authentication side of things working with Google but when the user accepts the request from Google, it redirects to a page which asks them to enter their email address before they can log in. But surely it will have retrieved this information from the Google login and should be able to simply log the user in so that they can use the site? How would I go about doing that? Thanks.

Accepted Answer

If you redirect the user to

```
{% provider_login_url 'google' %}
```

and allauth shows the user an intermediate page with

You are about to sign in using a third party account from Google.

when there is no other user associated with the same email address, then you need to add this configuration to bypass the intermediate page:

```
SOCIALACCOUNT_LOGIN_ON_GET=True
```

This was added in version 0.47.0, because of a potential vulnerability described in the change notes:

Automatically signing in users into their account and connecting additional third party accounts via a simple redirect ("/accounts/facebook/login/") can lead to unexpected results and become a security issue especially when the redirect is triggered from a malicious web site. For example, if an attacker prepares a malicious website that (ab)uses the Facebook password recovery mechanism to first sign into his/her own Facebook account, followed by a redirect to connect a new social account, you may end up with the attacker's Facebook account added to the account of the victim. To mitigate this, SOCIALACCOUNT_LOGIN_ON_GET is introduced.

I realise this is answering a slightly different question, because in this case the user isn't confirming an email, but it's related, because the user still doesn't directly sign up/log in.

Bypass signup form using allauth

Solution

Problem