Are there any security risks if we create pathauto roule so that the user account pages are at domain.com/username
On a site that is not using a mechanism like the one implemented from the Two-factor Authentication (TFA) module, letting visitors know usernames of existing accounts is giving out half of the credentials. It doesn't mean it is easier to log in on somebody else's account, though.
Somebody who got my password for a site could probably try to use the same password for another site's account where I am using the same username. If I were using the same credentials for more sites, that could work, but somebody could argue it is my fault for using the same credentials on different sites.
On my experience on Drupal.org, the bigger issue was not the username being publicly available, but third-party software used on the server, which caused unauthorized access to account information to emails, usernames, and hashed passwords.
That said, Drupal 8 core code is being changed to use the output of
User::getDisplayName() every time links to user accounts are given in a page.
User::getAccountName() should be used when displaying the name to administrator users, the user who owns the account, or for the username in the login context.
Using domain.com/username for the user account pages is going on the opposite direction. I would rather use the output of
User::getDisplayName() to build the path alias of user accounts pages.
As you are asking for a Pathauto pattern, this would mean using the [user:display-name] token when creating the pattern on admin/config/search/path/patterns.
Instead of domain.com/username, I would rather use domain.com/users/username or domain.com/u/username to avoid conflict with existing routes, or other path aliases.
To make an example of what could happen, I created a test site on simplytest.me where the user #1 is set with admin as username. I installed the Pathauto module and its dependencies, and I created a pattern for user entities using [user:display-name]. The result is that the URL for the user #1 became (after I bulk-updated the path aliases) https://dqth.ply.st/admin-0. (See the -0 part added not to create conflicts between the registered route and the path alias).
This is happens when the route is already defined when the path alias is created. I cannot predict what would happen when a module using a route with a path that already exists as path alias is installed.
Also, if you look at the code of
User::getDisplayName(), you will notice that by default it returns the username (the output of
User::getAccountName()). It will return something different only if there is a module that implements
hook_user_format_name_alter() and that module does alter the value of the
$name parameter it gets.
$name = $this ->getAccountName() ?: \Drupal::config('user.settings') ->get('anonymous'); \Drupal::moduleHandler() ->alter('user_format_name', $name, $this); return $name;
This means that you need to use the [user:display-name] token in the Pathauto pattern, but also install a module that implements
hook_user_format_name_alter(). For example, you could use the Real Name module which adds a Real name field to user entities, containing the value Drupal 8 will use as display name. You can also implement a custom module for that.