Login with Email or Username
Allows users to log in with either their username OR email address from the same input box on the standard login form.
login_emailusername
Install
composer require 'drupal/login_emailusername:^3.0'
composer require 'drupal/login_emailusername:^2.1'
Overview
Login Email or Username is a simple but practical Drupal module that enhances the user login experience by allowing authentication with either a username or email address in a single input field. This eliminates the need for users to remember which identifier they used during registration.
The module works transparently by modifying the standard Drupal login form, changing the 'Username' field to accept both usernames and email addresses. When an email address is entered, the module looks up the corresponding username and uses it for authentication. Email addresses take priority over usernames when both could potentially match.
Additionally, the module extends the REST API authentication endpoints, enabling headless or decoupled Drupal applications to also benefit from email-based login. Both the standard login endpoint and the password reset endpoint are enhanced to accept email addresses.
Features
- Login with username or email address in a single input field on the standard Drupal login form
- Automatic lookup of username when email address is provided
- Email addresses take priority over usernames during validation
- REST API support for email-based authentication via the user.login.http endpoint
- REST API support for password reset by email or username via the user.pass.http endpoint
- Zero configuration required - works immediately after installation
- Compatible with Drupal 10.3+ and Drupal 11
Use Cases
Standard site with email-based login
For sites where users are more likely to remember their email address than their username, this module provides a seamless login experience. Users simply enter their email address in the login form and authenticate normally without needing to look up or remember their username.
Decoupled/Headless Drupal applications
When building a headless Drupal application with a separate frontend (React, Vue, Angular, etc.), this module ensures the REST API login endpoint accepts email addresses. Frontend applications can send login requests with email addresses instead of requiring usernames.
Migration from other platforms
When migrating users from platforms that use email-based authentication (like WordPress or custom applications), this module allows users to continue logging in with their email addresses while Drupal maintains username-based accounts internally.
Sites with auto-generated usernames
For sites that automatically generate usernames during registration (e.g., from email addresses or random strings), users may not know or remember their assigned username. This module ensures they can always log in using their email address.
Tips
- The module requires no configuration - it works immediately after enabling
- Email addresses take priority over usernames during validation, so if a user enters text that matches both a username and another user's email, the email match will be used
- For REST API authentication, send credentials as JSON with 'name' (email or username) and 'pass' fields
- The module integrates seamlessly with Drupal's flood control and security features
- Password reset via REST API also supports email addresses in the 'name' field
Technical Details
Hooks 2
hook_help
Provides help text for the module on the admin help page.
hook_form_user_login_form_alter
Alters the standard Drupal user login form to accept email addresses in addition to usernames.
Troubleshooting 3
Clear Drupal's cache using drush cr or via /admin/config/development/performance. The route alterations require a cache rebuild to take effect.
Ensure you're sending the email address in the 'name' field of the JSON payload, not in a separate 'email' field. The API expects the standard format: {"name": "user@example.com", "pass": "password"}
If a username matches another user's email address, the email lookup takes priority. This is by design to ensure consistent behavior, though such situations should be rare in properly configured sites.
Security Notes 4
- The module maintains Drupal's built-in flood control for login attempts, protecting against brute force attacks
- Failed login attempts are properly logged regardless of whether username or email was used
- The module does not expose whether an email address exists in the system - invalid credentials return the same error message
- All authentication flows use Drupal's core security mechanisms without bypassing any security checks