don't allow self-deletion for an account that (still) uses 2fa#1695
don't allow self-deletion for an account that (still) uses 2fa#1695
Conversation
|
Maybe we should require passing MFA for users with it enabled instead? That's more complex to implement, but if a user is already at the point of self-deletion, we might as well not cause further frustration. |
Suggestion for PR #1695
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files
☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
I'm proposing the easy fix now because self-delete is already merged so 2fa self-delete is possible without the second factor. If we decide to instead do the second-factor check as part of the deletion, we can improve that later. |
3 participants
Small followup to #1668. While testing something else I noticed that we should probably make it harder for a 2FA user to self-delete. Rather than trying to check the second factor (complicated), I propose that we not allow self-deletion in this case. If you use 2FA and want to delete your account, first disable 2FA (which will require a code) and then proceed.
We ought to also block the SSO case, but I don't know how to set up an SSO environment to develop/test in. I propose spinning that off as a separate issue for the future and making sure we document this gap in the release notes.