🛠️Account deletion

Theory

Removing an account is a sensitive action that should be taken into consideration.

Practice

Some protection mechanisms should be incorporated:

1. Protection: when deleting an account, the web application should request the user to submit its credentials (it can prevent attacks such CSRF, XSS...).

Resources

Liberapay disclosed on HackerOne: Insecure Account DeletionHackerOne

#BugBounty — How I was able to delete anyone’s account in an Online Car Rental CompanyMedium