Skip to content

GitLab.com users without password must contact to delete account

Drew Blessing requested to merge dblessing_account_deletion_com into master

What does this MR do?

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/262658

This feature is for GitLab.com only. We should not allow a GitLab.com user to delete their account if their password was automatically set.

Adds a higher level of certainty that an individual deleting an account is the user. This is important for verification purposes.

Screenshots (strongly suggested)

Screen_Shot_2020-12-10_at_10.32.23_AM

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Drew Blessing

Merge request reports