User auto account deletion when using OAuth2

Question

Web app users can delete their accounts, they re-enter the password and if it fits, the account and its assets are removed (soft deletion).

They can register using an email (and a password) or using Facebook (hellojs and passport).

The self delete is simple for email+password registered users, for the rest we can't ask for their passwords because we don't have something to compare.

So the question is; should they be allowed to delete their account without extra security measures?, or there is a way to ask them to enter the pass in FB again, and that FB tells me it was ok?

About this question: it has some security aspects that could make it a fit for security.stackexchange, and some UX concerns that could go to the other specialized site, and API checks that may belong to SO, looks like it belongs here, since can't be 100% sure feel free to migrate/edit/close/etc.

Answer 1

If you're going to offer an irreversible destructive operation like this, forcing reauthentication sounds like an excellent idea. See https://developers.facebook.com/docs/facebook-login/reauthentication for how to do it with Facebook.

That said, I would lean towards also making deletion recoverable for some period. Eventually you'll encounter a case where someone had someone else's password and deleted it out of spite, and the someone else wants it back...