Just Delete Me – A directory of direct links to delete your account

Re:Just Delete Me – A directory of direct links to delete yo... by iwalton3 on Monday September 02, 2019 @12:09PM (#20859951)

Usually this is done by sending an nonce that must be sent back with the request to delete the account. The attacking site won't have the nonce, so it cannot delete the account.

Currently, you can also get a similar protection by requiring headers such as "Content-Type: application/json", since other sites will not be able to make that request.

Referer does work in some cases, but it is fairly common for users to disable the Referer, so relying on it for site functionality is not ideal.

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by t0astbread on Monday September 02, 2019 @08:31PM (#20862762)

How's the resource containing the nonce any more secure than just a plain "delete-account" endpoint?

Thinking about it, you could probably use CORS and some methods like X-Frame-Options to protect your nonce. But then you could just use that on the whole deletion page and avoid the nonce, I guess?

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by vortico on Tuesday September 03, 2019 @01:43AM (#20863973)

The nonce would only be available if you scrape the page while logged in and extract the logout URL, which is impossible with iframes.

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by t0astbread on Tuesday September 03, 2019 @04:52AM (#20864752)

Could you not still scrape the HTTP response for the page containing the nonce?

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by vortico on Tuesday September 03, 2019 @07:27AM (#20865472)

Not with a browser, no.

[ Parent | on HN ]