title: Facebook OAuth login - ID or email
body: <p>I'd like to offer our users a Facebook login option. But I'm not sure how to identify existing users (without a stored Facebook ID).</p>
  
  <p>From the docs:
  <a href="https://developers.facebook.com/docs/facebook-login/multiple-providers#addingfacebook" rel="nofollow">https://developers.facebook.com/docs/facebook-login/multiple-providers#addingfacebook</a></p>
  
  <blockquote>
    <p>After a successful login using Facebook, you will have the person's
    email address, Facebook ID, and access token. Your <strong>app should search
    for an existing account that has been created with that same email
    address</strong>. If one exists, you should merge the two accounts and add
    the Facebook info to the existing account - as recommended above.</p>
  </blockquote>
  
  <p>That doesn't sound like a secure approach to me. What would prevent someone from creating a new Facebook account with a fake email address that matches a user account in my app and then use my Facebook login option? (Obviously, this will not work if the user already owns a Facebook account)</p>