4

When authenticated user in a particular role is trying to access a page (by manually typing URL) to which the user's role does not have permission: It is better to show an access denied page or redirect the user to the landing page ? Need answers from UX and security perspective.

7

There's a 3rd option for security concerns: denying a page exists

Working on enterprise software, I've come across feature request for customers who used our platform:

Customers who do not want to show or hint to an unauthenticated (or forbidden) user that a certain type of content even exists for those who do not have permission.

So instead of a '403 Forbidden' page, the solution was to give a 404. We kept the wording vague, with a link to the homepage, login form upper right, and a search field.

Here's an example from a Github 404 page (although it's cheeky, which might not be appropriate for your site).

enter image description here

You may not have the same security or intellectual property concerns, so in that case a 403 page would at least let them know that further permissions are needed (But they know there's content that exists).

Directing users to the homepage will not inform them of their insufficient permissions and they may mistake this for content that's not found, or make them think they have the wrong URL, when in actuality it's a permissions issue.

Due to our (and our customers) security concerns we concluded that a 404 is a better solution.

  • Is giving false information a good idea? – Shreyas Tripathy Jun 29 '17 at 6:25
  • @ShreyasTripathy Sometimes, yes. It's a bit like the "I can neither confirm nor deny..." (when clearly the speaker could confirm one way or the other if they chose to). Sometimes for business/security reasons, you don't want to give out too much information, even if that means technically lying. – TripeHound Jun 29 '17 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.