# User still able to log in after anonymization
**URL:** https://meta.discourse.org/t/user-still-able-to-log-in-after-anonymization/389673
**Category:** Bug
**Tags:** anonymization
**Created:** [November 26, 2025, 2:07am UTC](https://meta.discourse.org/t/user-still-able-to-log-in-after-anonymization/389673 "2025-11-26T02:07:05Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@stuwest](https://meta.discourse.org/u/stuwest)
#### Post date: [November 26, 2025, 2:07am UTC](https://meta.discourse.org/t/user-still-able-to-log-in-after-anonymization/389673/1 "2025-11-26T02:07:05Z")
The moderation team on the Discourse instance I admin received a request from a user who wanted to leave the forum. Specifically, they asked that their account be anonymized and that we remove their ability to log in to the forum in future. (We’re a login required, invite-only community.)
Around 12:30pm today I anonymized the account. Since I had read [here](https://meta.discourse.org/t/anonymizing-users-in-discourse/86929) and in other places on Meta that anonymization removes the ability to log in, I thought I was done. Around an hour later I received a message that the user was still able to read the forum and urgently wanted to be locked out. It occurred to me that even if anonymizing the account means the user can’t log back in, possibly that only takes effect once they log out, so I went to the anonymized profile and hit the Log Out button.
A little after 4pm I received a message that the user was still able to log in and desperately wanted not to be able to. I was confused but thought maybe a browser cache issue? Unlikely as that seems. But when I went to the anonymized profile, I could clearly see that they were still accessing the forum.
(I had renamed the account from anon566etc to RetiredMember566etc because we don’t allow anonymous posting and users had started to flag the anonymized posts, thinking there was some sort of issue.)
As far as I could see the anonymization procedure had worked as expected; the email address had been changed.
In the end I both deactivated the account and suspended the user, and one or other of those seems to have done the trick.
In this (admittedly slightly unusual) case, the user was the one who wanted not to be able to login, but in future if we anonymize an account the moderators and admins might want the user to lose access the forum. I can’t figure out what went wrong in this case - does anyone have any thoughts? We’re using commit [6e39bb9728](https://github.com/discourse/discourse/commits/6e39bb9728e65d5f6c9c95ba6be756b0242feec2), in case that helps.
---
### Author:  [@ToddZ](https://meta.discourse.org/u/ToddZ)
#### Post date: [November 26, 2025, 3:46am UTC](https://meta.discourse.org/t/user-still-able-to-log-in-after-anonymization/389673/2 "2025-11-26T03:46:26Z")
The scenario of a user who “urgently” and “desperately” wants to be locked out sure feels strange. But what you saw does seem unintended:
> [@Can an anonymized user log in?](https://meta.discourse.org/t/can-an-anonymized-user-log-in/276038/2):
>
> No they can’t. It’s game over.
Does the error log have anything interesting for that timeframe..?
---
### Author:  [@stuwest](https://meta.discourse.org/u/stuwest)
#### Post date: [November 26, 2025, 4:01am UTC](https://meta.discourse.org/t/user-still-able-to-log-in-after-anonymization/389673/3 "2025-11-26T04:01:32Z")
No, nothing in the error log today.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 26, 2025, 4:18am UTC](https://meta.discourse.org/t/user-still-able-to-log-in-after-anonymization/389673/4 "2025-11-26T04:18:20Z")
computer says there is a bug here, will see if I can quickly fix it.
> **[Discourse Anonymization Doesn't Log Users Out](https://meta.discourse.org/discourse-ai/ai-bot/shared-ai-conversations/chBEHIoYq65nJxNQltpeHg)**
>
> sam: The moderation team on the Discourse instance I admin received a request from a user who wanted to leave the forum. Specifically, they asked that their account be anonymized and that we remove their ability to log in to the forum in future. (We’re a login required, invite-only community.)
> Around 12:30pm today I anonymized the account. Since I had read here and in other places on Meta that anonymi…
[https://github.com/discourse/discourse/pull/36242](https://github.com/discourse/discourse/pull/36242)
This should catch a lot more.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 30, 2025, 9:00pm UTC](https://meta.discourse.org/t/user-still-able-to-log-in-after-anonymization/389673/5 "2025-11-30T21:00:02Z")
This topic was automatically closed after 4 days. New replies are no longer allowed.