0

I'm developing an web API and I'm trying to follow the principles of REST. I'm now at the stage of creating the endpoint where a user can delete its own account. I have also implemented JWT functionality where the JWT is valid for 1 day.

I want to add an extra layer of security when the user is deleting its own account. My idea is that the user have to provide its current password in the body of the delete request. I did some googling which pointed to having a body in a delete request is a bad idea because some entities does not support it, e.g. the Angular HttpClient, some web services might strip the body, etc.

I know GitHub have a similar functionality when deleting a repository, you have to provide your password. I like this feature because it prevents unauthorized persons from spoofing the JWT on critical operations, right?

What are your recommendations

Proceed with using DELETE and deal with the potential problems that might come along with this approach?

Instead use POST, PUT or PATCH even though it would look semantically wrong?

Other solution?

Slamdunk
  • 424
  • 1
  • 8
  • 20

1 Answers1

1

I would not recommend to use other http methods like put or patch if you really want to delete it and not only disable it. That would not be intuitive for the API user and could lead to misunderstandings.

One solution for your use case is to introduce an additional resource (e. g. deletionRequest) to request (but not immediately execute) the deletion of the profile with a post call. Then you could do the actual deletion with a delay (preferably longer than the token life span). You could then inform the user via email about the deletion, so the real user has the chance to revoke the deletion. If the user does not react in time, the deletion is executed.

Philipp
  • 470
  • 2
  • 10
  • Yeah I could introduce a request mechanism but I think I will actually go with PATCH here, even though it's not intuitive. A request mechanism would add complexity with Cron jobs and such. Thanks for your answer. – Slamdunk Jun 12 '20 at 08:18
  • Fair enough. At the end I think it is a design decision and there is no right or wrong. I totally understand your complexity argument. – Philipp Jun 12 '20 at 18:54