Password reentry should be required for actions listed under Account

[nbitzz]

Password reentry should be required for actions listed under the Account section of the account management menu. In addition, the "I forgot my password" should send an email containing a link to reset an account password, instead of just sending a link which logs the user in.

[Jack5079]

Don't forget .well-known/change-password for the apple users

[nbitzz]

doesn't exactly relate to the issue; the password change system is currently locked to the client SPA but it would be a good idea to make a separate page for it and implement 👍

[nbitzz]

I just realized how the fuck is this going to be implemented with the DELETE method

[nbitzz]

How do we implement this for account deletion? @Jack5079
Few ideas:

• POST /account/:userId/delete, with a password parameter
• Password in query string (FEAR)
• PATCH /account/:userId having a delete:true option
• DELETE /account/:userId provides some route to POST to with your password to continue if you're not an administrator