Anonymous users can edit all anonymous users content

Question

Drupal has a edit own content permission for each content type.

I have given the Article: edit own content to anonymous users and discovered that Drupal doesn't differentiate between different anonymous users, which means that an anonymous user has the permission to edit all the Article nodes created by anonymous users.

It seems that a sessions isn't really created for users until they sign in. So there isn't a session to identify anonymous users. Even then, the code checks the user ID, which is 0 for all the anonymous users.

Is this a bug with the permission, or can it be resolved?

I have seen other modules attempt to differentiate between different anonymous users. I think there was a flag for anonymous users. Then there is a few session based modules, but I don't see how these can help.

Answer 1

The anonymous user is a single user. Other systems have a concept of "anonymous users", but in Drupal it is called the anonymous user because from the standpoint of the system, in most senses, there is only one.

In particular, with respect to managing content, Drupal assigns user IDs to check permissions.

The anonymous user has an ID of 0, so everything created by the anonymous user is linked by the 0 user ID.

As a result, there are probably not many use cases where you would want to give edit permissions to the anonymous user for content. (This is not a criticism of your use case; what I am saying is that because of the way Drupal treats the anonymous user the same no matter who is anonymous, you will probably want to find a different way to implement your use case.)

Some modules support saving a draft for anonymous users, such as Webform, but for managing content by different people, they need to have accounts.

If you try to hack on some kind of support for distinguishing between anonymous users, you are quite likely to run into problems with the caching layer and run the risk of exposing data from one anonymous user to another.