Destructive Identity Operations Explained: Login-Method Removal and Full User Deletion
Short answer: treat login-method removal as a recoverable credential change, but treat full user deletion as an irreversible, observable workflow that revokes every session before personal data is erased. The page says gdpr_delete_stuck , and the on-call view is uncomfortable: the identity row is gone, yet the session-validity probe still accepts a refresh token issued before deletion. For a…
Short answer: The source material emphasizes the importance of treating login-method removal and full user deletion as distinct operations with specific postconditions. Login-method removal should ensure that the removed authenticator can no longer start sessions and still provides a way to regain access. Full deletion must prevent existing sessions from authorizing requests, prevent new sessions from being issued, and ensure personal data enters a bounded erasure workflow.
The key takeaway is that recovery introduces different threat models and erasure requirements compared to removal.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
