Just Delete Me – A directory of direct links to delete your account

Re:Just Delete Me – A directory of direct links to delete yo... by t0astbread on Monday September 02, 2019 @08:31PM (#20862762)

How's the resource containing the nonce any more secure than just a plain "delete-account" endpoint?

Thinking about it, you could probably use CORS and some methods like X-Frame-Options to protect your nonce. But then you could just use that on the whole deletion page and avoid the nonce, I guess?

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by vortico on Tuesday September 03, 2019 @01:43AM (#20863973)

The nonce would only be available if you scrape the page while logged in and extract the logout URL, which is impossible with iframes.

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by t0astbread on Tuesday September 03, 2019 @04:52AM (#20864752)

Could you not still scrape the HTTP response for the page containing the nonce?

[ Parent | on HN ]

Re:Just Delete Me – A directory of direct links to delete yo... by vortico on Tuesday September 03, 2019 @07:27AM (#20865472)

Not with a browser, no.

[ Parent | on HN ]