Ways to reproduce
- Create django model with
USERNAME_FIELD set as email
- Create user with some email
- Try to log in via social auth under the user with the same email
Expected behaviour
AuthForbidden should be raised, because originally this user was not created via social auth
Actual behaviour
User is being logged in
Looks like if username field for the model is email then user will be logged in by this email even though it may be unsafe as it was mentioned in associate_by_email pipeline's docs
Is this an expected behavior?


https://github.com/python-social-auth/social-app-django/blob/master/social_django/storage.py#L91