Supabase auth signup for already existing email id and a potential security vulnerability

[Prateek32177]

I am facing few issue in my auth flow,
Scenario
When user already exist with an email id and email is confirmed
Auth is still allowing to signup with same email id and not returning already exist error,

I know that it's intentional and it returns fake user data but I don't want it this way I want to show user already exist,

Please suggest a way,

Scenario 2
When user sign up with new email id but didn't confirmed mail and have status waiting for verification,
In this case I want to allow user to resend confirmation how can I identify if email already exist but confirmation is not completed yet,
One weird thing I found here is in case someone have signed up but not yet confirmed with email again with same email but different meta data and along with user name password if we send meta data like firstname last name then they don't override means meta data will remain same which was filled for the first time. Ideally it should override IMO.

I am kinda block due to this please advise,
FYI : I already tried identities.length =0 way which works fine with email already exist and verified but not with waiting for verification status emails

[GaryAustin1]

You could create an rpc call to a security definer postgres function to see if an email exists.

There is this "anomaly"...

So if you turn off phone confirm I think email would respond like you want.

I don't understand 2.

[Prateek32177]

Let me explain scenario 2 ,
So for the very first time I signed up and in auth table my email id got added with other info but status is waiting for verification means email confirmation not done.

Now if you again signup with same email Id it will allow the signup and resend the confirmation link but password will not get overriden, password will remain same as used for the first time, this is big security issue someone can use it as a loophole,

[Prateek32177]

A person with wrong intentions to access someone else account he will send the signup with someone's email ID in future or some day if actual owner of that email would signup with new password, the password will be the one which first guy with wrong intention entered and now email confirmation is also completed by the actual person, this can be a security vulnerability. Hope I am able to explain.

[xiaoyazz]

Hi I'm having the same issue with scenario 1. May I ask how you solved it? Thank you.