Another user creates an account, using the same password
Right now, this allows the second user to log into the system as the first user, as (a) we don’t require email verification before login and (b) our auth0 config treats these two as different users (we do not on our backend side).
Rather than requiring a user to verify their email before they can log in, I’d rather prevent re-registeration via email/password when there’s a passwordless account.
Is there a canned hook for doing this? And is this a fairly standard thing to do? I’m a bit surprised by the defaults here.
Ya, I saw those examples and actually implemented one. But it struck me as odd that I would have to do that, and wondered why the out-of-the-box behavior is permissive. i.e. I feel like I’m missing something on why this isn’t the default - which I wanted to check before implementing.
