Incorrect Google "username" value?

[jkriss]

It looks like the Google strategy sets both username and name to displayName. Shouldn't username be the primary email address, or at least something unique?

https://github.com/lipp/login-with/blob/master/src/strategies/google.js#L23-L24

[lipp]

Yeah, Google strategy is a bit special:

Normally e.g. on GitHub username=lipp and name=Gerhard Preuss. Likewise with other strategies. However, the username for google probably is the email (e.g. gelipp@gmail.com).

login-with considers email as precious private information which should only be exposed via http-only cookie. username and user in turn are intended for displaying information like:

"hello lipp! welcome back, btw your name is Gerhard Preuss"

without further API calls, so this information should not be http-only to make them available to JS (SPA).

I hope you agree with that decision (you can also downvote this :)).

However, as other people asked for the email to be included in the cookie, i'll create an issue #41 .

[jkriss]

At least for my purposes, it's fine to keep email out of the profile cookie, as long as it's in the jwt. I do think that username also carries a connotation of uniqueness, but maybe that's a different question.

[lipp]

Yeah, maybe putting the email in the jwt http-only cookie makes sense. So can I close this issue? I'll create an issue for including the email in the jwt.

[jkriss]

That sounds great to me. Thanks!