An admin can't delete their own account: two lines of defense in my users destroy endpoint

The author recounts a personal experience of inadvertently deleting their admin account due to a testing error. To prevent such incidents, they implemented two crucial lines of defense in their user-delete endpoint.

The first line of defense checks if the authenticated user is attempting to delete themselves. If so, the endpoint returns a 422 HTTP status code with a clear error message indicating that an account cannot be deleted by its owner. This check utilizes Eloquent's is() method, which compares the model's key and table, ensuring a proper comparison without getting confused by integer vs. string data types.

The second line of defense involves deleting the user's personal access tokens before deleting the user's account itself. Sanctum users, for instance, have separate token rows in a different table. Simply deleting the user without first removing their tokens could leave orphaned tokens, which is a security risk. By deleting the tokens first, the endpoint guarantees that no abandoned tokens remain, and it also ensures that any active sessions on different devices are terminated simultaneously with the user's deletion.

These two lines of defense are implemented server-side and are not circumvented by frontend measures, such as disabling the delete button on the user's own row. The author emphasizes that endpoints are the ultimate safeguard against unauthorized actions, as they are called by various components, including scripts, tests, and mobile applications.

The author claims that this approach, implemented in their Laravel + React SaaS Starter Kit, ensures a trustworthy foundation for their applications. They offer the starter kit for purchase at $19 for a one-time fee.