I'm using Drupal 8 and I have a security requirement to prevent authenticated users from seeing other authenticated users' profiles.
I have a view which customizes the user profile page of each authenticated user. Each logged in user can see their own profile by accessing the path /user-profile/userId.
Now if the user decided to randomly change the userId in the URL, they cannot access other users' profiles, since, in the view I have set the 'Filter Criteria' to current user. Which works perfectly.
However, if a user decided to randomly change the userId in the path /user/userId they will have access to other users information. What I need to do is to prevent them from accessing /user/userId.
It's important to mention that the users are free to change their own information using the URL /user/userId/edit