🛠️ Account deletion

Theory

Removing an account is a sensitive action that should be taken into consideration.

Practice

Some protection mechanisms should be incorporated:

1. Protection: when deleting an account, the web application should request the user to submit its credentials (it can prevent attacks such CSRF, XSS...).

Resources

https://hackerone.com/reports/361368

https://infosecwriteups.com/bugbounty-how-i-was-able-to-delete-anyones-account-in-an-online-car-rental-company-8a4022cc611