1

I'm using Drupal 8 and I have a security requirement to prevent authenticated users from seeing other authenticated users' profiles.

I have a view which customizes the user profile page of each authenticated user. Each logged in user can see their own profile by accessing the path /user-profile/userId.

Now if the user decided to randomly change the userId in the URL, they cannot access other users' profiles, since, in the view I have set the 'Filter Criteria' to current user. Which works perfectly.

However, if a user decided to randomly change the userId in the path /user/userId they will have access to other users information. What I need to do is to prevent them from accessing /user/userId.

It's important to mention that the users are free to change their own information using the URL /user/userId/edit

Any suggestions?

3

You should change the permission for authenticated users.

Go to admin/people/permissions and under user permissions dissallow authenticated users to View user information

enter image description here

1
  • thank you, I hate how trivial that was, cheers – ram_griever May 28 '20 at 5:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.