{
  "id": 15115435,
  "title": "An admin can't delete their own account: two lines of defense in my users destroy endpoint",
  "url": "https://urgent.news/2026/10/17/an-admin-cant-delete-their-own-account-two-lines-of-defense-in-my",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-17T04:12:53.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/kamrankhandev/an-admin-cant-delete-their-own-account-two-lines-of-defense-in-my-users-destroy-endpoint-17kn"
  },
  "original_language": "en",
  "account": "The author recounts a personal experience of inadvertently deleting their admin account due to a testing error. To prevent such incidents, they implemented two crucial lines of defense in their user-delete endpoint.\n\nThe first line of defense checks if the authenticated user is attempting to delete themselves. If so, the endpoint returns a 422 HTTP status code with a clear error message indicating that an account cannot be deleted by its owner. This check utilizes Eloquent's is() method, which compares the model's key and table, ensuring a proper comparison without getting confused by integer vs. string data types.\n\nThe second line of defense involves deleting the user's personal access tokens before deleting the user's account itself. Sanctum users, for instance, have separate token rows in a different table. Simply deleting the user without first removing their tokens could leave orphaned tokens, which is a security risk. By deleting the tokens first, the endpoint guarantees that no abandoned tokens remain, and it also ensures that any active sessions on different devices are terminated simultaneously with the user's deletion.\n\nThese two lines of defense are implemented server-side and are not circumvented by frontend measures, such as disabling the delete button on the user's own row. The author emphasizes that endpoints are the ultimate safeguard against unauthorized actions, as they are called by various components, including scripts, tests, and mobile applications.\n\nThe author claims that this approach, implemented in their Laravel + React SaaS Starter Kit, ensures a trustworthy foundation for their applications. They offer the starter kit for purchase at $19 for a one-time fee.",
  "summary": "I nearly locked myself out of my own admin panel once. Testing the user-delete button, clicked my own row out of habit, confirmed the modal without thinking. The account was gone. So were all its sessions — obviously — and I had to re-seed the database to get back in. The fix is two lines, and both belong on the backend, not in a confirm dialog. Frontend confirm dialogs are a suggestion. The API…",
  "key_points": [
    "Admin cannot delete their own account due to built-in defense",
    "First defense returns 422 error if user tries to delete self",
    "Second defense deletes tokens before deleting user account"
  ],
  "editors_take": "Implementing server-side safeguards against self-deletion and orphaned tokens shifts security responsibility away from the frontend to ensure that administrative errors and abandoned sessions do not compromise application integrity.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}