Answers.Body: <p>I think you hit the nail on the head!</p>
  
  <p>Including the <code>userId</code> in the front-end form give them the perfect opportunity to delete whoever they want... even just by guessing random IDs. That definitely seems like a huge security risk.</p>
  
  <p>But if you build your own custom controller, you can <strong><em>guarantee</em></strong> that the current user is the one being deleted.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-11-06T18:09:42.103Z
Answers.Text: +1 for a plugin with your own controller.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-11-06T22:18:21.930Z
Answers.Text: Thanks Lindsey! I figured this would be the way to go, just thought I'd check see if I'd missed anything :)
Answers.UserDisplayName: Josh Angell
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-04-01T15:27:10.847Z
Answers.Text: How does one use the deleteUser function? In the Craft 3 Class Reference, there is https://docs.craftcms.com/api/v3/craft-elements-actions-deleteusers.html and https://docs.craftcms.com/api/v3/craft-controllers-userscontroller.html#public-methods but I cannot find more info on its usage.
Answers.UserDisplayName: iamkeir
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-04-02T03:24:29.673Z
Answers.Text: @iamkeir You should create a [new question](https://craftcms.stackexchange.com/questions/ask). Feel free to link back to this page if you feel it is relevant. This particular thread was answered and closed in 2014... the answer is actually specific to Craft 2, not Craft 3.
Answers.UserDisplayName: Lindsey D
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-11-06T17:49:49.907Z
Answers.LastActivityDate: 2014-11-06T17:49:49.907Z
Answers.UserDisplayName: Lindsey D
Answers.Body: <p>There's now a plugin for this: <a href="https://plugins.craftcms.com/delete-account" rel="nofollow noreferrer">https://plugins.craftcms.com/delete-account</a></p>
  <blockquote>
  <p>Delete Account is a Craft CMS plugin that allows users to delete their own account within Twig templates (Front end). This also adheres to GDPR rules regarding users being able to manage their own data and delete their account.</p>
  </blockquote>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-03-22T10:01:03.820Z
Answers.LastActivityDate: 2021-03-22T10:01:03.820Z
Answers.UserDisplayName: Tamlyn
Body: <p>I'd like to allow a non-admin user to remove their own account from the front end of my app, without allowing them CP access.</p>
  
  <p>I'm concerned that if I give the user group <code>deleteUser</code> permissions they will just be able to delete any other non-admin user if they change the values of my forms hidden inputs.</p>
  
  <p>Here is my current form:</p>
  
  <pre><code>&lt;form method="post" accept-charset="UTF-8"&gt;
    {{ getCsrfInput() }}
    &lt;input type="hidden" name="action" value="users/deleteUser"&gt;
    &lt;input type="hidden" name="redirect" value="account/delete/success"&gt;
    &lt;input type="hidden" name="userId" value="{{ currentUser.id }}"&gt;
    &lt;button type="submit" class="btn  btn--red"&gt;Delete my account!&lt;/button&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>Is it best that I create a custom controller action to handle this and first check they are only deleting themselves before passing it off to the <code>craft()-&gt;users-&gt;deleteUser()</code> function? Or is there a better way?</p>
  
Tags: <plugin-development><users>
Title: Allow user to delete their own account from the front end
ThreadText: # Allow user to delete their own account from the front end
  
  (Asked by: username_0 on 2014-11-06)
  
  I'd like to allow a non-admin user to remove their own account from the front end of my app, without allowing them CP access.
  
  I'm concerned that if I give the user group `deleteUser` permissions they will just be able to delete any other non-admin user if they change the values of my forms hidden inputs.
  
  Here is my current form:
  
  ```
  <form method="post" accept-charset="UTF-8">
    {{ getCsrfInput() }}
    <input type="hidden" name="action" value="users/deleteUser">
    <input type="hidden" name="redirect" value="account/delete/success">
    <input type="hidden" name="userId" value="{{ currentUser.id }}">
    <button type="submit" class="btn  btn--red">Delete my account!</button>
  </form>
  
  ```
  
  Is it best that I create a custom controller action to handle this and first check they are only deleting themselves before passing it off to the `craft()->users->deleteUser()` function? Or is there a better way?
  
  **Tags:** plugin-development, users
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2014-11-06. Score: 5 | Accepted answer
  
  I think you hit the nail on the head!
  
  Including the `userId` in the front-end form give them the perfect opportunity to delete whoever they want... even just by guessing random IDs. That definitely seems like a huge security risk.
  
  But if you build your own custom controller, you can ***guarantee*** that the current user is the one being deleted.
  
  > **Comments:**
  > **username_2**: +1 for a plugin with your own controller.  
  > **username_0**: Thanks username_1! I figured this would be the way to go, just thought I'd check see if I'd missed anything :)  
  > **username_3**: How does one use the deleteUser function? In the Craft 3 Class Reference, there is https://docs.craftcms.com/api/v3/craft-elements-actions-deleteusers.html and https://docs.craftcms.com/api/v3/craft-controllers-userscontroller.html#public-methods but I cannot find more info on its usage.  
  > **username_1**: @username_3 You should create a [new question](https://craftcms.stackexchange.com/questions/ask). Feel free to link back to this page if you feel it is relevant. This particular thread was answered and closed in 2014... the answer is actually specific to Craft 2, not Craft 3.  
  
  ---
  
  ### Answer by username_4 on 2021-03-22. Score: 1
  
  There's now a plugin for this: <https://plugins.craftcms.com/delete-account>
  
  > Delete Account is a Craft CMS plugin that allows users to delete their own account within Twig templates (Front end). This also adheres to GDPR rules regarding users being able to manage their own data and delete their account.
  
  
  ---
  
  