Are there any security risks if we create pathauto roule so that the user account pages are at domain.com/username

  • I usually try my best not to expose user names on a Drupal site since that is typically half of a login for a default install of Drupal. Then its just a guessing game for passwords. Example, user/1 gets aliased and now the world knows your super user username. Some may think thats okay, some may not. I don't.
    – Kevin
    Apr 24, 2018 at 14:31
  • Please don’t add things like please don’t downvote to posts - members of the community are trusted to use their votes as they see fit (within normal bounds of course), and the question itself isn’t a place for commentary on the question. Many thanks!
    – Clive
    Apr 24, 2018 at 14:33
  • To add to that, one thing you can add is Rabbit Hole so you can set per user if their profile page is accessible or not to the public. But I still would not expose usernames.
    – Kevin
    Apr 24, 2018 at 14:41

1 Answer 1


On a site that is not using a mechanism like the one implemented from the Two-factor Authentication (TFA) module, letting visitors know usernames of existing accounts is giving out half of the credentials. It doesn't mean it is easier to log in on somebody else's account, though.
Somebody who got my password for a site could probably try to use the same password for another site's account where I am using the same username. If I were using the same credentials for more sites, that could work, but somebody could argue it is my fault for using the same credentials on different sites.

On my experience on Drupal.org, the bigger issue was not the username being publicly available, but third-party software used on the server, which caused unauthorized access to account information to emails, usernames, and hashed passwords.

That said, Drupal 8 core code is being changed to use the output of User::getDisplayName() every time links to user accounts are given in a page. User::getAccountName() should be used when displaying the name to administrator users, the user who owns the account, or for the username in the login context.
Using domain.com/username for the user account pages is going on the opposite direction. I would rather use the output of User::getDisplayName() to build the path alias of user accounts pages.

As you are asking for a Pathauto pattern, this would mean using the [user:display-name] token when creating the pattern on admin/config/search/path/patterns.


Instead of domain.com/username, I would rather use domain.com/users/username or domain.com/u/username to avoid conflict with existing routes, or other path aliases.

To make an example of what could happen, I created a test site on simplytest.me where the user #1 is set with admin as username. I installed the Pathauto module and its dependencies, and I created a pattern for user entities using [user:display-name]. The result is that the URL for the user #1 became (after I bulk-updated the path aliases) https://dqth.ply.st/admin-0. (See the -0 part added not to create conflicts between the registered route and the path alias).
This is happens when the route is already defined when the path alias is created. I cannot predict what would happen when a module using a route with a path that already exists as path alias is installed.

Also, if you look at the code of User::getDisplayName(), you will notice that by default it returns the username (the output of User::getAccountName()). It will return something different only if there is a module that implements hook_user_format_name_alter() and that module does alter the value of the $name parameter it gets.

$name = $this
  ->getAccountName() ?: \Drupal::config('user.settings')
  ->alter('user_format_name', $name, $this);
return $name;

This means that you need to use the [user:display-name] token in the Pathauto pattern, but also install a module that implements hook_user_format_name_alter(). For example, you could use the Real Name module which adds a Real name field to user entities, containing the value Drupal 8 will use as display name. You can also implement a custom module for that.

  • 1
    +1 on using the display name (which would be the display-name token when using pathauto IIRC), but note that by default, the value from those two methods is the same, unless a module actually implements hook_user_format_name_alter() and e.g. uses the first + lastname field to make up the actual username. Additionally, pathauto should also make sure to never allow overridding a system path, e.g. with a display name of "admin" or "frontpage". So if you're ok with the whatever information you are using to build that path exposed, then you should be OK.
    – Berdir
    Apr 24, 2018 at 17:19
  • @Berdir Yes, I should expand my answer to make clearer those points, and also that using domain.com/username instead of (for example) domain.com/u/username could be cause of conflict with existing routes.
    – apaderno
    Apr 24, 2018 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.