I have a few basic fields on the user object to display "Author Bio" cards at the bottom of articles. It seems that anonymous users cannot see any of this information.

All I want to do is show first name, last name, phone number and email address. Is this hidden away because it requires "View User Profile" permission? How can I get around enabling that? I don't want to enable that if I don't have to. Conversely, how I can prevent anyone from getting to user/* pages?

Is there something I can change in the render array to change the access check?

  • Attaching a View to the content type with EVA and providing the node author for a contextual filter?
    – 4uk4
    Commented Dec 18, 2017 at 16:49
  • Hmmm... so it’s already a View Block in a region on the page, let me check the settings
    – Kevin
    Commented Dec 18, 2017 at 16:52
  • The EVA display would be if you want to include this in a view mode of the content type (can be displayed in multiple nodes on the same page). A view block display with a contextual filter is OK, if you want to display this for the author of the current node (then of course only for one node at the same time).
    – 4uk4
    Commented Dec 18, 2017 at 16:58
  • This is coming from a user reference field actually, not the node author core field. The field is set to render the user entity in a given view mode, the view Block is looking at the current node for the field value to render it in a block display.
    – Kevin
    Commented Dec 18, 2017 at 17:31
  • In this case it might be easier if you switch the view to field mode and add a relationship to the referenced user, then all field values should be available.
    – 4uk4
    Commented Dec 18, 2017 at 17:40

1 Answer 1


Conversely, how I can prevent anyone from getting to user/* pages?

Getting technical here, you wouldn't want to block all /user/*; otherwise, you wouldn't be able to /user/login or /user/logout and also you would still want admins to access those /user/{uid} pages.

If you inspect core/modules/user/user.routing.yml you can see most of the user routes. But what you expect, the /user/{uid} is not defined here.

It's actually defined in UserRouteProvider.php as /user/{user}

enter image description here

You can easily find the route name by enabling WebProfiler module that comes with Devel and going to /user/1

enter image description here

Now all you gotta do is override the route's access by giving it a role of administrator.


namespace Drupal\mymodule\Routing;
use Drupal\Core\Routing\RouteSubscriberBase;
use Symfony\Component\Routing\RouteCollection;

 * Listens to the dynamic route events.
class RouteSubscriber extends RouteSubscriberBase {

   * {@inheritdoc}
  protected function alterRoutes(RouteCollection $collection) {
    // Allow only admins to access '/user/{user}'.
    if ($route = $collection->get('entity.user.canonical')) {
        $route->setRequirement('_role', 'administrator');


Alternatively, in your custom module, you could create a new permission and use that for the Route's setRequirement instead and then assign the new permission to the roles that you want to have access.


    class: Drupal\mymodule\Routing\RouteSubscriber
      - { name: event_subscriber }

For more in depth information about altering routes, see: Altering existing routes and adding new routes based on dynamic ones.

  • 1
    Yeah, when I said that I basically meant I did not want any non authenticated user to be able to access the user pages beyond login or forgot password. At the same time I really don't want anyone to get there even if they are authenticated, and this might be the only path.
    – Kevin
    Commented Dec 19, 2017 at 15:28
  • @Kevin yeah I figured, I only stated that for correctness; for the sake of non expert readers who might see this.
    – No Sssweat
    Commented Dec 19, 2017 at 23:17
  • @Kevin curious to know what you ended up doing.
    – No Sssweat
    Commented Jan 4, 2018 at 5:34
  • Wound up giving the permission for the short term until we have time to try this
    – Kevin
    Commented Jan 4, 2018 at 5:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.