github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #926] User deletion flow is flawed: problems with UX and DX #8503

New Issue
Closed
opened 2026-04-13 03:35:32 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-13 03:35:32 -05:00
Owner
Copy Link

Originally created by @JosipPardon on GitHub (Dec 17, 2024).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/926

Is this suited for github?

  • Yes, this is suited for github

Current vs. Expected behavior

According to docs, recommended way of setting up user deletion feature is this:

  1. Add sendDeleteAccountVerification to betterAuth({...}) in auth.ts.
  2. When user presses delete account, call authClient.deleteUser(), which triggers execution of sendDeleteAccountVerification
  3. Inside sendDeleteAccountVerification send email with URL for account deletion, which is user expected to click: sendEmail(data.user.email, "Verify Deletion", data.url)

Problem is that this URL leads to API endpoint. When user opens it, he sees this:

{FF16826C-6081-4B67-B5B7-DE2BA1AAED69}

Users should not be expected to visit API endpoints and open pages which are actually json objects, like one above.

My recommendation is this:

  1. Rename authClient.deleteUser() to authClient.sendUserDeletionToken() because original name is misleading, but keep original functionality.
  2. Create new function authClient.deleteUser({token: string}) which sends request to same URL described above, or deletes user in some other way.

So, flow should be similar as for email OTP (described here) - we have authClient.emailOtp.sendVerificationOtp and authClient.signIn.emailOtp.

If they want, inside sendDeleteAccountVerification developers can send user email with link to page which executes authClient.deleteUser({token: string}) when opened. This is how link verification can be implemented.

What version of Better Auth are you using?

1.0.21

Originally created by @JosipPardon on GitHub (Dec 17, 2024). Original GitHub issue: https://github.com/better-auth/better-auth/issues/926 ### Is this suited for github? - [X] Yes, this is suited for github ### Current vs. Expected behavior According to [docs](https://www.better-auth.com/docs/concepts/users-accounts#delete-user), recommended way of setting up user deletion feature is this: 1. Add `sendDeleteAccountVerification` to `betterAuth({...})` in `auth.ts`. 2. When user presses _delete account_, call `authClient.deleteUser()`, which triggers execution of `sendDeleteAccountVerification` 3. Inside `sendDeleteAccountVerification` send email with URL for account deletion, which is user expected to click: `sendEmail(data.user.email, "Verify Deletion", data.url)` Problem is that this URL leads to API endpoint. When user opens it, he sees this: ![{FF16826C-6081-4B67-B5B7-DE2BA1AAED69}](https://github.com/user-attachments/assets/5afcb379-9181-4de7-be6b-1337f1898705) Users should not be expected to visit API endpoints and open pages which are actually json objects, like one above. My recommendation is this: 1. Rename `authClient.deleteUser()` to `authClient.sendUserDeletionToken()` because original name is misleading, but keep original functionality. 2. Create new function `authClient.deleteUser({token: string})` which sends request to same URL described above, or deletes user in some other way. So, flow should be similar as for email OTP (described [here](https://www.better-auth.com/docs/plugins/email-otp#send-otp)) - we have `authClient.emailOtp.sendVerificationOtp` and `authClient.signIn.emailOtp`. If they want, inside `sendDeleteAccountVerification` developers can send user email with link to page which executes `authClient.deleteUser({token: string})` when opened. This is how link verification can be implemented. ### What version of Better Auth are you using? 1.0.21
GiteaMirror added the lockedbug labels 2026-04-13 03:35:32 -05:00
GiteaMirror commented 2026-04-13 03:35:36 -05:00
Author
Owner
Copy Link

@daveycodez commented on GitHub (Dec 18, 2024):

Is it possible to delete users without needing email verification to do so?

<!-- gh-comment-id:2552473119 --> @daveycodez commented on GitHub (Dec 18, 2024): Is it possible to delete users without needing email verification to do so?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#8503
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?