Juice-shop: Data subject contact form

[bkimminich]

A new contact form should be added to retrieve and ask deletion for a users personal data stored by the Juice Shop.

This form should check for secret question and maybe some other (new) factor that makes it difficult - but not impossible - to forge for other users.

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[devanshbatra04]

Seems interesting. Can I take this up?

[bkimminich]

Totally, yes! You could just start with the request form, and we can design a challenge into it afterwards? I was also thinking this would be a good place for the advanced CAPTCHA idea.

[devanshbatra04]

The advanced CAPTCHA? Not sure I follow :confused:
Sure, I will make the form. Really want to get into more Angular :smile:

[bkimminich]

In #784 having a better CAPTCHA than the math term to solve for feedback form was suggested. This could in fact be implemented on this data subject form, as Juice Shop support really wants to avoid spam here.

[aaryan01]

@bkimminich @J12934 what all data should be removed? The past orders and reviews?

[agrawalarpit14]

@aaryan01 Please let me know if you are working on this. If not I can start. @bkimminich

[aaryan01]

@agrawalarpit14 I have started working on it. Just needed some clarification from @bkimminich .

[agrawalarpit14]

Sure. Thanks!!✌🏻

[supra08]

@aaryan01, I can start to work on the user data removal part of this issue if you are not currently working on it, along with the relevant tests. I guess this way we can complete both the parts in parallel. @bkimminich

[aaryan01]

Sure, I'm currently working on export data.

[bkimminich]

Just to be clear, this feature does not delete anything. It is just meant to be a distinct contact form where users can ask for their personal data (which could just offer a link to "Data Export") or be deleted in accordance with GDPR. This could end up in the DB as a new table PrivacyRequests and have a free text column and a deletionRequested flag. Additional ideas are welcome.

[supra08]

@bkimminich, so should I keep the secret question as the authentication?
Apart from that, I plan to remove(hide) the same data that is exported in the data export feature. Is this implementation fine?

[lock[bot]]

This thread has been automatically locked because it has not had recent activity after it was closed. :lock: Please open a new issue for regressions or related bugs.

[lock[bot]]

This thread has been automatically locked because it has not had recent activity after it was closed. :lock: Please open a new issue for regressions or related bugs.